Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://filedm.com/j...

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/07/2026, 23:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://filedm.com/jnlBr
  • Sample260708-27e1ksbs8s
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Drops file in Windows directory 57 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 48 IoCs
  • Modifies registry class 54 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
        2⤵
        • Enumerates system info in registry
        PID:7060
        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x280,0x284,0x288,0x21c,0x28c,0x7ff7fb712900,0x7ff7fb71290c,0x7ff7fb712918
          3⤵
            PID:6892
          • C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe" --version
            3⤵
              PID:7204
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://filedm.com/jnlBr
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3384
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa2e3bc188,0x7ffa2e3bc194,0x7ffa2e3bc1a0
            2⤵
              PID:1480
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,75289135456325332,16578116388923030339,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
              2⤵
              • Downloads MZ/PE file
              • System Time Discovery
              PID:4192
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,12088764905882728035,3582317407932290792,262144 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
              2⤵
                PID:4532
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,10014480126011825522,400077416132512051,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
                2⤵
                  PID:2624
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,198688126363833281,10317751682771802411,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
                  2⤵
                    PID:4040
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,3869460950083322184,2061958459049123254,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                    2⤵
                      PID:1992
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,11820036686064529950,15646342848173163837,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
                      2⤵
                        PID:2416
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,15915550593146295781,16118002306921085489,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
                        2⤵
                          PID:5104
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4244,i,6436125919246313214,2771571368265876598,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
                          2⤵
                            PID:492
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4268,i,780463775671561718,9455711176997895569,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:9
                            2⤵
                              PID:4176
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,16543708422439118424,12258194135720677844,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
                              2⤵
                                PID:1840
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12747065315158521549,11107586860579234977,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
                                2⤵
                                  PID:2936
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,302941408227635769,16030999705574180966,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
                                  2⤵
                                    PID:1988
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,16009642487790155202,12177145441855626451,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1388
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                      cookie_exporter.exe --cookie-json=1128
                                      3⤵
                                        PID:3348
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,302941408227635769,16030999705574180966,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
                                      2⤵
                                        PID:3116
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6416,i,1850198239505934598,12007902682283347181,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
                                        2⤵
                                          PID:4916
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6768,i,12877114363348697376,3826538402545603590,2097152 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
                                          2⤵
                                            PID:3628
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,5227377071621017125,3252931776422410831,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
                                            2⤵
                                              PID:4964
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,3716516613433940297,10400192135826510340,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
                                              2⤵
                                              • Subvert Trust Controls: Mark-of-the-Web Bypass
                                              • NTFS ADS
                                              PID:1064
                                            • C:\Users\Admin\Downloads\ByteBreaker V2_55241264.exe
                                              "C:\Users\Admin\Downloads\ByteBreaker V2_55241264.exe"
                                              2⤵
                                              • Downloads MZ/PE file
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:2548
                                              • C:\Users\Admin\AppData\Local\OperaGX_55241264.exe
                                                C:\Users\Admin\AppData\Local\OperaGX_55241264.exe --silent --allusers=0
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2116
                                                • C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe
                                                  C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe --silent --allusers=0 --server-tracking-blob=ODZlMTU5YTllM2NhYjYzNjMwMjY1NjVmYTBjYmU2OGIxYjFmOGJjZjBhNTBjOWJlODBmZDZmNzE3ZDZkMTNmMDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTMyMTlhZmM4MTJjNTQ1ZGY5NDQ5NDI5M2NmMDAwNzY1IiwidGltZXN0YW1wIjoiMTc4MzU1MjQyNy41MzAyIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiMzIxOWFmYzgxMmM1NDVkZjk0NDk0MjkzY2YwMDA3NjUiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0YTc2MzgxZS0xOGI3LTQ4Y2UtODZlOS00Y2FhMWRmMWRlMTMifQ==
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Enumerates connected drives
                                                  • Enumerates system info in registry
                                                  • Modifies system certificate store
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2164
                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe
                                                    C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.18 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff67672cd88,0x7ff67672cd94,0x7ff67672cda0
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:4200
                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\installer.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\installer.exe" --version
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:4444
                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2164 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_20260709001349" --session-guid=826db45a-0e0d-44d2-b4e3-9d2f1d4c7b04 --server-tracking-blob=YzQ1MWU5ODk2MTFjMmUyMDkzNzU4OGZiNjM5YWExNjVjNTJiZWU5YjljN2Y4YWY3ZDMzMzZiMzNjYzcwOTliZTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTMyMTlhZmM4MTJjNTQ1ZGY5NDQ5NDI5M2NmMDAwNzY1Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzgzNTUyNDI3LjUzMDIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiIzMjE5YWZjODEyYzU0NWRmOTQ0OTQyOTNjZjAwMDc2NSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjRhNzYzODFlLTE4YjctNDhjZS04NmU5LTRjYWExZGYxZGUxMyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=4406000000000000
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Enumerates connected drives
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3916
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.18 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff67672cd88,0x7ff67672cd94,0x7ff67672cda0
                                                      6⤵
                                                      • Executes dropped EXE
                                                      PID:3660
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\installer.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\installer.exe" --backend --initial-pid=2164 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491" --session-guid=826db45a-0e0d-44d2-b4e3-9d2f1d4c7b04 --server-tracking-blob=YzQ1MWU5ODk2MTFjMmUyMDkzNzU4OGZiNjM5YWExNjVjNTJiZWU5YjljN2Y4YWY3ZDMzMzZiMzNjYzcwOTliZTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTMyMTlhZmM4MTJjNTQ1ZGY5NDQ5NDI5M2NmMDAwNzY1Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzgzNTUyNDI3LjUzMDIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiIzMjE5YWZjODEyYzU0NWRmOTQ0OTQyOTNjZjAwMDc2NSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjRhNzYzODFlLTE4YjctNDhjZS04NmU5LTRjYWExZGYxZGUxMyJ9 --silent --desktopshortcut=1 --install-subfolder=132.0.5905.110
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Enumerates connected drives
                                                      • Enumerates system info in registry
                                                      • Modifies registry class
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4040
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\installer.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff7038a6e08,0x7ff7038a6e14,0x7ff7038a6e20
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:776
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Adds Run key to start application
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4300
                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xdd4b80,0xdd4b8c,0xdd4b98
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3788
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2280
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x1084b80,0x1084b8c,0x1084b98
                                                            9⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4160
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                                                            9⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Enumerates system info in registry
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:3944
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                              10⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:4176
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff9f645f070,0x7ff9f645f080,0x7ff9f645f090
                                                                11⤵
                                                                • Executes dropped EXE
                                                                PID:3688
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                              10⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:5076
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff9f645f070,0x7ff9f645f080,0x7ff9f645f090
                                                                11⤵
                                                                • Executes dropped EXE
                                                                PID:4256
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0xdc8378,0xdc8384,0xdc8390
                                                              10⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:5132
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                11⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Enumerates system info in registry
                                                                PID:5152
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff9f645f070,0x7ff9f645f080,0x7ff9f645f090
                                                                  12⤵
                                                                  • Executes dropped EXE
                                                                  PID:5184
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                11⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:5304
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff9f645f070,0x7ff9f645f080,0x7ff9f645f090
                                                                  12⤵
                                                                  • Executes dropped EXE
                                                                  PID:5364
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                                                                11⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Enumerates system info in registry
                                                                PID:6076
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x150,0x154,0x158,0x14c,0x15c,0x7ff9f645f070,0x7ff9f645f080,0x7ff9f645f090
                                                                  12⤵
                                                                  • Executes dropped EXE
                                                                  PID:3356
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Adds Run key to start application
                                                        • Drops file in Windows directory
                                                        • Checks processor information in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:1780
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff9f645f070,0x7ff9f645f080,0x7ff9f645f090
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:3772
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,4850273488447911603,1341410396186580544,262144 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:2
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:5400
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=1836,i,3132055409913838934,8400230579881800233,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2028 /prefetch:11
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • System Time Discovery
                                                          • Enumerates system info in registry
                                                          PID:5408
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2280,i,694191127006659305,17855543110624217803,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2292 /prefetch:13
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5508
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3204,i,5348491081425800750,14149776878181816024,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3132 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5776
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3188,i,2971389927156558954,16792179350427705536,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3260 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:5784
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3176,i,8493183995411445099,3619873972219306819,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3236 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5792
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3164,i,15565823609768751952,16880051431605229344,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3324 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5800
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3224,i,6191938193717536001,10381603893881395774,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3336 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5808
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3248,i,786152808266443944,13140632854441580030,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3348 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5816
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3904,i,18022702854602186540,6566400970037023462,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3900 /prefetch:1
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5856
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_gx_splash.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:5316
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4548,i,16056979014094098944,1912723663771116882,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4580 /prefetch:1
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5268
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4780,i,3715059414460029540,4002517865625440145,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4796 /prefetch:9
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:6020
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4960,i,10006030479276438772,7106418606441605894,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4984 /prefetch:1
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5440
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5208,i,8271632861621229271,14039578451384795660,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5204 /prefetch:1
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5596
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5224,i,15934680696760487812,363461338388804316,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5348 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:5312
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5332,i,16622562607469774431,17815021751578002965,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5420 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:5492
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5328,i,8581138334379503067,4869411265332984915,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5452 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5140
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5336,i,10546255430096844664,6871256140376687265,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5476 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:5620
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6392,i,808388088407469347,1664842126656545253,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6428 /prefetch:9
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:6940
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6604,i,14570268070582587574,1930613522553173202,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6656 /prefetch:9
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7112
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6644,i,5856202188777444670,561531631688482481,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6880 /prefetch:1
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7124
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7052,i,6053846186032174946,10184929816778429515,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7088 /prefetch:9
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:6404
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6912,i,3735675486679223285,11843016468626923183,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6592 /prefetch:12
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7056
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7400,i,11285971278268229183,2597666663084856668,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7416 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:7616
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7540,i,7733572178189513098,14925488880224149426,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7244 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7628
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7564,i,4995956458602235910,5951117411379295352,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7576 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7636
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7828,i,11393445687429278257,1620652682486735314,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7836 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7652
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7976,i,16183590158940826041,5302886085273740908,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7984 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Enumerates system info in registry
                                                          PID:7664
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8144,i,10020491074371128538,6507866431627445410,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8156 /prefetch:14
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7676
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8296,i,5672558060016816737,2018433365306289452,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8308 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:7688
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8456,i,12660781101698298299,9359085226228659069,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8464 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7700
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8484,i,17248762122659452780,3057651926006138960,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8496 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7708
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8528,i,3087013862296548556,15165675169006038704,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8408 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7724
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8760,i,5808496224559255794,1837436918384379739,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8900 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7736
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9060,i,12046164879403044411,13913814183555221975,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9096 /prefetch:9
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:7748
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9224,i,13215297690111138119,18028955038363450041,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9228 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:7760
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9388,i,1656282159234532216,9570455859369849515,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9336 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:6748
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9408,i,12277168241054852395,17321637520805124462,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9528 /prefetch:14
                                                          8⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Enumerates system info in registry
                                                          PID:6760
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                                                          8⤵
                                                          • Enumerates system info in registry
                                                          PID:7412
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff7fb712900,0x7ff7fb71290c,0x7ff7fb712918
                                                            9⤵
                                                              PID:7784
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9652,i,3201318520375898193,15220455757504413553,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=9776 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:6104
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8928,i,1449945132568991610,4109299937350146852,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=9572 /prefetch:1
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:7876
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10292,i,9282269909596296739,13963236564044158097,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10284 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:6688
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10512,i,4265547692351854317,10563036466530294237,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=9748 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:7092
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10480,i,16099085880314219573,9869020511182950944,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=6896 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:7308
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10304,i,11957896257382790721,2518415300395323638,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=10396 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:7744
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8436,i,6901742926335288002,2373188217294862945,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=10460 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:1688
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7892,i,18159772799526812940,5723475091771371510,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=6376 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:2784
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9052,i,15291616496300403171,10569231511384216437,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=7048 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:7264
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8884,i,14451106772493052656,13318168382954084649,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=3480 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:6376
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3492,i,5636857761632710539,6535172907329784128,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=6036 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:5264
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6032,i,4885108489307313631,13582222672507624014,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=6372 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:7908
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10300,i,2174165832820162072,4530590363731288761,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=7880 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:8188
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10460,i,14067777129458045388,15195061289092942301,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=5792 /prefetch:14
                                                            8⤵
                                                            • Enumerates system info in registry
                                                            PID:6392
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=4112,i,282288414936000262,14693896796462461122,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=4092 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:6428
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3764,i,9237627827349354078,6387008986294640514,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=4060 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:1336
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8628,i,7063720896161310104,5954032021171788673,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=8444 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:6044
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=8644,i,698621522834184949,5485324032761226496,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=8516 /prefetch:9
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:7724
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3308,i,8250581456676498210,7760490046105682730,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=8688 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:7808
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5536,i,12838068771053559127,5699145166595170138,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=3476 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:2784
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3172,i,8142138615270789975,10353064643183963213,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=5612 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:7260
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7500,i,6657855542700862788,13982174639332884977,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=7464 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:8004
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=10624,i,17807487886896115750,4818928885084803628,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=11124 /prefetch:9
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:5976
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=3412,i,18410991537901448534,9674490628970541372,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=3388 /prefetch:9
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:7832
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10100,i,18371272089237816856,17373528316428538334,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=4032 /prefetch:14
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:7052
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=7712,i,3568819767366833263,17139994928337695354,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=3512 /prefetch:9
                                                            8⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Enumerates system info in registry
                                                            PID:6408
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=11224,i,17670094250108011767,5680801848269108647,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=11148 /prefetch:9
                                                            8⤵
                                                              PID:6816
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 OPR/132.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=9040,i,12563358517655201354,11129708304292773244,2097152 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=10624 /prefetch:9
                                                              8⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:2008
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-shopping-aliexpress-cms-configuration=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:continue-shopping-otto-cms-configuration=on --with-feature:domain-suggestions-confidence-scoring=off --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:startup-campaigns=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=11184,i,2629513484743766717,13210475215303854479,524288 --field-trial-handle=1884,i,17136690714023793072,16118963541356998140,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1960,i,7813222224391211438,7604411929543894213,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=11172 /prefetch:14
                                                              8⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Enumerates system info in registry
                                                              PID:3152
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:1064
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe" --version
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Enumerates system info in registry
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3028
                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xdd4b80,0xdd4b8c,0xdd4b98
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4920
                                                  • C:\Program Files\Booster\GameBooster.exe
                                                    "C:\Program Files\Booster\GameBooster.exe" install
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    PID:3280
                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                    3⤵
                                                    • Opens file in notepad (likely ransom note)
                                                    PID:5212
                                                  • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
                                                    3⤵
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:6732
                                                    • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                      C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:wIOXJAkUAaq8YEtfKaPOPN -o:0
                                                      4⤵
                                                      • Drops file in System32 directory
                                                      • Modifies trusted root certificate store through registry
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies system certificate store
                                                      PID:7712
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1913363553863263746,16449204279928299373,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
                                                  2⤵
                                                    PID:3772
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9314184076670508700,2592664767462335097,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
                                                    2⤵
                                                      PID:1996
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,217565407728039218,15841921626143256770,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
                                                      2⤵
                                                        PID:1704
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,6618231292930085829,15507105920659126525,524288 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
                                                        2⤵
                                                          PID:4448
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6976,i,4108321879216896091,5937618620396039770,262144 --field-trial-handle=2536,i,7888001304782072369,22252971602851423,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:10
                                                          2⤵
                                                            PID:5840
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:1012
                                                          • C:\Program Files\Booster\GameBooster.exe
                                                            "C:\Program Files\Booster\GameBooster.exe"
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Modifies data under HKEY_USERS
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2824
                                                            • C:\Program Files\Booster\GameBooster.exe
                                                              "C:\Program Files\Booster\GameBooster.exe" --minimized
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:4388
                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                            1⤵
                                                              PID:6036
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Enumerates system info in registry
                                                              PID:6516
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7ff9f645f070,0x7ff9f645f080,0x7ff9f645f090
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:6608
                                                            • C:\Program Files (x86)\PremierOpinion\pmservice.exe
                                                              "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
                                                              1⤵
                                                              • Drops file in Program Files directory
                                                              • Modifies trusted root certificate store through registry
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies data under HKEY_USERS
                                                              • Modifies system certificate store
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:8108
                                                              • C:\Windows\system32\rundll32.exe
                                                                C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1204
                                                                2⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:6916
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
                                                                2⤵
                                                                • Drops file in Program Files directory
                                                                • Drops file in Windows directory
                                                                PID:5828
                                                              • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                "c:\program files (x86)\premieropinion\pmropn.exe" -boot
                                                                2⤵
                                                                • Drops file in Program Files directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SendNotifyMessage
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2224
                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                  CheckNetIsolation.exe LoopbackExempt -s
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:8140
                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                  CheckNetIsolation.exe LoopbackExempt -s
                                                                  3⤵
                                                                    PID:6596
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 2224
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:7548
                                                                  • C:\PROGRA~2\PREMIE~1\pmropn32.exe
                                                                    C:\PROGRA~2\PREMIE~1\pmropn32.exe 2224
                                                                    3⤵
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:6132
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 2224
                                                                  2⤵
                                                                    PID:6008
                                                                    • C:\PROGRA~2\PREMIE~1\pmropn64.exe
                                                                      C:\PROGRA~2\PREMIE~1\pmropn64.exe 2224
                                                                      3⤵
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:8168
                                                                  • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                    "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5992
                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6564
                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy
                                                                      3⤵
                                                                        PID:8012
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy
                                                                        3⤵
                                                                          PID:4568
                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=f46d4000-fd22-4db4-ac8e-4e1ddde828fe_cw5n1h2txyewy
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:8096
                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7980
                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.accountscontrol_cw5n1h2txyewy
                                                                          3⤵
                                                                            PID:2152
                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.asynctextservice_8wekyb3d8bbwe
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1212
                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bingnews_8wekyb3d8bbwe
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:7872
                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bingweather_8wekyb3d8bbwe
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5840
                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bioenrollment_cw5n1h2txyewy
                                                                            3⤵
                                                                              PID:7796
                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.creddialoghost_cw5n1h2txyewy
                                                                              3⤵
                                                                                PID:6468
                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.desktopappinstaller_8wekyb3d8bbwe
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:8188
                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
                                                                                3⤵
                                                                                  PID:6436
                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.gamingapp_8wekyb3d8bbwe
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:7120
                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.gethelp_8wekyb3d8bbwe
                                                                                  3⤵
                                                                                    PID:8088
                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.heifimageextension_8wekyb3d8bbwe
                                                                                    3⤵
                                                                                      PID:7852
                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.lockapp_cw5n1h2txyewy
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:7116
                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:8112
                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe
                                                                                      3⤵
                                                                                        PID:6832
                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedgedevtoolsclient_8wekyb3d8bbwe
                                                                                        3⤵
                                                                                          PID:7328
                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftofficehub_8wekyb3d8bbwe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2100
                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftsolitairecollection_8wekyb3d8bbwe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4876
                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftstickynotes_8wekyb3d8bbwe
                                                                                          3⤵
                                                                                            PID:6816
                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.net.native.framework.2.2_8wekyb3d8bbwe
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:6488
                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.net.native.runtime.2.2_8wekyb3d8bbwe
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • System Time Discovery
                                                                                            PID:1668
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              4⤵
                                                                                                PID:8012
                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.onedrivesync_8wekyb3d8bbwe
                                                                                              3⤵
                                                                                                PID:7016
                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.people_8wekyb3d8bbwe
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:8068
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  4⤵
                                                                                                    PID:8096
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.powerautomatedesktop_8wekyb3d8bbwe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:7728
                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.storepurchaseapp_8wekyb3d8bbwe
                                                                                                  3⤵
                                                                                                    PID:5228
                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.todos_8wekyb3d8bbwe
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5628
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      4⤵
                                                                                                        PID:1212
                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.4_8wekyb3d8bbwe
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:7884
                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.cbs_8wekyb3d8bbwe
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:6376
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        4⤵
                                                                                                          PID:5840
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00.uwpdesktop_8wekyb3d8bbwe
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:5912
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:6468
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vp9videoextensions_8wekyb3d8bbwe
                                                                                                        3⤵
                                                                                                          PID:8188
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.webmediaextensions_8wekyb3d8bbwe
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1688
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.webpimageextension_8wekyb3d8bbwe
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:7580
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1072
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.apprep.chxapp_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:7984
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:3184
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.callingshellapp_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:6232
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.capturepicker_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:7376
                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.cloudexperiencehost_cw5n1h2txyewy
                                                                                                          3⤵
                                                                                                            PID:7312
                                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.contentdeliverymanager_cw5n1h2txyewy
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2484
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              4⤵
                                                                                                                PID:7328
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
                                                                                                              3⤵
                                                                                                                PID:2292
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  4⤵
                                                                                                                    PID:2100
                                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy
                                                                                                                  3⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:7840
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    4⤵
                                                                                                                      PID:4876
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:6816
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.parentalcontrols_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:6488
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.peopleexperiencehost_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:7628
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5828
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.search_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5452
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:8096
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:6476
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2936
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.xgpuejectdialog_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:6432
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsalarms_8wekyb3d8bbwe
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5724
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowscalculator_8wekyb3d8bbwe
                                                                                                                    3⤵
                                                                                                                      PID:7796
                                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsfeedbackhub_8wekyb3d8bbwe
                                                                                                                      3⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:6996
                                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsmaps_8wekyb3d8bbwe
                                                                                                                      3⤵
                                                                                                                        PID:7176
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowssoundrecorder_8wekyb3d8bbwe
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:7400
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windowsterminal_8wekyb3d8bbwe
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:7672
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xbox.tcui_8wekyb3d8bbwe
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1424
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xboxgamecallableui_cw5n1h2txyewy
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:6248
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xboxgameoverlay_8wekyb3d8bbwe
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:6840
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3444
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.undockeddevkit_cw5n1h2txyewy
                                                                                                                        3⤵
                                                                                                                          PID:7856
                                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=ncsiuwpapp_8wekyb3d8bbwe
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:8164
                                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=windows.cbspreview_cw5n1h2txyewy
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:7244
                                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=windows.printdialog_cw5n1h2txyewy
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3776
                                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:6904
                                                                                                                    • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:8020

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Reconnaissance

                                                                                                                            Resource Development

                                                                                                                            Initial Access

                                                                                                                            Execution

                                                                                                                            Persistence

                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                            1
                                                                                                                            T1547

                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                            1
                                                                                                                            T1547.001

                                                                                                                            Event Triggered Execution

                                                                                                                            1
                                                                                                                            T1546

                                                                                                                            Component Object Model Hijacking

                                                                                                                            1
                                                                                                                            T1546.015

                                                                                                                            Privilege Escalation

                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                            1
                                                                                                                            T1547

                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                            1
                                                                                                                            T1547.001

                                                                                                                            Event Triggered Execution

                                                                                                                            1
                                                                                                                            T1546

                                                                                                                            Component Object Model Hijacking

                                                                                                                            1
                                                                                                                            T1546.015

                                                                                                                            Defense Evasion

                                                                                                                            Modify Registry

                                                                                                                            3
                                                                                                                            T1112

                                                                                                                            Subvert Trust Controls

                                                                                                                            3
                                                                                                                            T1553

                                                                                                                            Install Root Certificate

                                                                                                                            2
                                                                                                                            T1553.004

                                                                                                                            SIP and Trust Provider Hijacking

                                                                                                                            1
                                                                                                                            T1553.003

                                                                                                                            Credential Access

                                                                                                                            Credentials from Password Stores

                                                                                                                            1
                                                                                                                            T1555

                                                                                                                            Credentials from Web Browsers

                                                                                                                            1
                                                                                                                            T1555.003

                                                                                                                            Unsecured Credentials

                                                                                                                            1
                                                                                                                            T1552

                                                                                                                            Credentials In Files

                                                                                                                            1
                                                                                                                            T1552.001

                                                                                                                            Discovery

                                                                                                                            Browser Information Discovery

                                                                                                                            1
                                                                                                                            T1217

                                                                                                                            Network Share Discovery

                                                                                                                            1
                                                                                                                            T1135

                                                                                                                            Password Policy Discovery

                                                                                                                            1
                                                                                                                            T1201

                                                                                                                            Peripheral Device Discovery

                                                                                                                            1
                                                                                                                            T1120

                                                                                                                            Query Registry

                                                                                                                            5
                                                                                                                            T1012

                                                                                                                            System Information Discovery

                                                                                                                            4
                                                                                                                            T1082

                                                                                                                            System Location Discovery

                                                                                                                            1
                                                                                                                            T1614

                                                                                                                            System Language Discovery

                                                                                                                            1
                                                                                                                            T1614.001

                                                                                                                            System Network Configuration Discovery

                                                                                                                            1
                                                                                                                            T1016

                                                                                                                            Internet Connection Discovery

                                                                                                                            1
                                                                                                                            T1016.001

                                                                                                                            System Time Discovery

                                                                                                                            1
                                                                                                                            T1124

                                                                                                                            Lateral Movement

                                                                                                                            Collection

                                                                                                                            Data from Local System

                                                                                                                            1
                                                                                                                            T1005

                                                                                                                            Command and Control

                                                                                                                            Exfiltration

                                                                                                                            Impact

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            snt.dat
                                                                                                                            • Path C:\PROGRA~2\PREMIE~1\snt.dat
                                                                                                                            • Size 3.4MB
                                                                                                                            • SHA256 53c3531376e680c38a4783b498bf99da36653f70c8d7dcb650a27b32ef14e737
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            cacert.pem
                                                                                                                            • Path C:\Program Files (x86)\PremierOpinion\cacert.pem
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            pmls.dll
                                                                                                                            • Path C:\Program Files (x86)\PremierOpinion\pmls.dll
                                                                                                                            • Size 884KB
                                                                                                                            • SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            pmls64.dll
                                                                                                                            • Path C:\Program Files (x86)\PremierOpinion\pmls64.dll
                                                                                                                            • Size 1.1MB
                                                                                                                            • SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            pmph.dll
                                                                                                                            • Path C:\Program Files (x86)\PremierOpinion\pmph.dll
                                                                                                                            • Size 806KB
                                                                                                                            • SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            pmropn.exe
                                                                                                                            • Path C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                                                                            • Size 7.4MB
                                                                                                                            • SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            pmropn32.exe
                                                                                                                            • Path C:\Program Files (x86)\PremierOpinion\pmropn32.exe
                                                                                                                            • Size 244KB
                                                                                                                            • SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            pmropn64.exe
                                                                                                                            • Path C:\Program Files (x86)\PremierOpinion\pmropn64.exe
                                                                                                                            • Size 303KB
                                                                                                                            • SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            GameBooster.exe
                                                                                                                            • Path C:\Program Files\Booster\GameBooster.exe
                                                                                                                            • Size 710KB
                                                                                                                            • SHA256 21db9cc5433b37291909184a5b53c26edbfd0aff217404afc1e1dcd8e5b8db1c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            hgsdk.dll
                                                                                                                            • Path C:\Program Files\Booster\hgsdk.dll
                                                                                                                            • Size 7.4MB
                                                                                                                            • SHA256 2720d215168108700767f8e9b57819d55ca139d69d8d828186da186850a37c6c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                            • Size 528B
                                                                                                                            • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                            • Size 471B
                                                                                                                            • SHA256 ef2bf88deb86676e32b59247fcbbc9dfa5c2e19e9cfd2b5218f223e60f1855cb
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                            • Size 174B
                                                                                                                            • SHA256 bc6a0145cf88849c02641fc889a8af40c7ebc615697567e9e8ee123f43d4a7ff
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                            • Size 170B
                                                                                                                            • SHA256 9c41a9eb183d13b2465cd42e9d89cb0ced708cf85f1d0febda78b59dc0c8b722
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                            • Size 416B
                                                                                                                            • SHA256 74a914067d94c34e59581cc09a711fda2f0e46cda604731882ee9d1fb2d6cf8f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            blocklist
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                            • Size 105KB
                                                                                                                            • SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            1d97cb7f-b5dd-4ae9-b9c1-3ea71e114e51.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d97cb7f-b5dd-4ae9-b9c1-3ea71e114e51.tmp
                                                                                                                            • Size 106KB
                                                                                                                            • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                            • Size 6B
                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 fa0805a429105a70c78d7773ca29cb19879244bd3e6cae7c6bff5f96918997c7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index~RFe587b07.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587b07.TMP
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 699b22c1118f51e20c47399da514416deb19886998368929053bbcf448c58d2e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SiteList-Enterprise.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Edge Profile.ico
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                            • Size 70KB
                                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            4a7198af-c5fc-4256-8f89-666ac6ea40ad.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a7198af-c5fc-4256-8f89-666ac6ea40ad.tmp
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 1ad8e8687b88f07e7f89b846ffaf653ceba5eff0dff2cbde0ebdd9cd97ca55db
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 111B
                                                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 37d3f33b660a1c42318770f279df53c226f3fee4738f1017e87434080fb894e4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 14KB
                                                                                                                            • SHA256 7d7432f56bc87af3d8d90c24e224294c96986b1feeb2611cf74e0e58d2064357
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                            • Size 31KB
                                                                                                                            • SHA256 3feca2e7420e0ea706ce9a77137452c1bda3c9f4e42539f4517e9419b48a9492
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            sync_diagnostic.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 38fee22264d77fbe303c834c2a55a756bba2125c0a0a6a49f9b9b5636b7a8d60
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            OperationConfig
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            OperationConfig~RFe58dcee.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58dcee.TMP
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 19KB
                                                                                                                            • SHA256 e3b540f0008d720850d9064faed645810ceaa929086d15c0bec68e181ca210cf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 19KB
                                                                                                                            • SHA256 25d0e3a73ef0286422a64b05cb6d0f30baecffad7443864f64af7a04c3c15cb8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 f11823a6b40bec6d10058739057f118b7d1896feca6195b77e0422b0c4b0624c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 b56c901afec456929caef73af01113c8e3cc0285b4d817bf601cc1be9ad6c5a4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 f9ad6f74bcd26e88a0d3e38331a35224c92a038cc1e3bd0206826f2b4912cdec
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 19KB
                                                                                                                            • SHA256 0be4bec06b8e159f6b6624fb5f19ca7e6cc181f3b17c6a90fec0b5e52e6e1773
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            4f38a325-063f-4b94-aa40-6d4daad5464f.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f38a325-063f-4b94-aa40-6d4daad5464f.tmp
                                                                                                                            • Size 13B
                                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            OperaGX_55241264.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\OperaGX_55241264.exe
                                                                                                                            • Size 3.9MB
                                                                                                                            • SHA256 8a707e9c0b51c1b9bd4d6cabf28e4ae79485e9a11f2386f413502ef969127c78
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            132.0.5905.110.manifest
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\132.0.5905.110.manifest
                                                                                                                            • Size 227B
                                                                                                                            • SHA256 df1569534f041c96339c6c4070f8e18bd6c658e84fa6c8b869c09c8b2fc9cd8f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            150x150Logo.scale-100.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\Assets\150x150Logo.scale-100.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 9635c074c9d8edde0baf3111dbd7db49cbdc370c4f729c80ac382949f32be526
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            150x150Logo.scale-100_contrast-white.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\Assets\150x150Logo.scale-100_contrast-white.png
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 28ce8fcb22080ce1f69346cb0720bbe5662959e413426f00062b706013da8c28
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            150x150Logo.scale-140.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\Assets\150x150Logo.scale-140.png
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 a36a13a5d5e3d39e3018ccc5f8859944c87256f8be24a3c08a6bf3cb06a26804
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            150x150Logo.scale-140_contrast-white.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\Assets\150x150Logo.scale-140_contrast-white.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 0bd63fe653885286e180fbdf6d1dadc66af242b8ed6bd1d03d8c5eccc20e91d7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            installer.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\installer.exe
                                                                                                                            • Size 9.1MB
                                                                                                                            • SHA256 593e924356e452df074c66d8d88a4e83cf359b0341738297cd0bbbf165c950f3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            custom_partner_content.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\132.0.5905.110\resources\custom_partner_content.json
                                                                                                                            • Size 245KB
                                                                                                                            • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            browser_assistant.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                                                                                                                            • Size 5.2MB
                                                                                                                            • SHA256 4a5fd953fd0e1c3085ae68fa3984083b6273b2fecad4cbd5149f9b20a720e7e5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            opera_autoupdate.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                            • Size 7.3MB
                                                                                                                            • SHA256 645805f067a633514d144f065f2f251a2b4f2fa9e0cf45703df8cc0332047557
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            installer_prefs.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 73518551fbc6ac7f3b6daadf12fa8df759eab477516da2cb20f4bded80c658f4
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            opera.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                            • Size 2.8MB
                                                                                                                            • SHA256 654b8bae07a3455bb481cde49b07ade01c07cd530802a2a363d34140d09e7f94
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Opera GX Browser.lnk
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\Opera GX Browser.lnk
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 4872f9889df15f01d53937731b0cb28b7b8b14f0a04b325cb2b24b588eb170ea
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            additional_file0.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\additional_file0.tmp
                                                                                                                            • Size 2.8MB
                                                                                                                            • SHA256 0f50bda78a34e09ccfd5e33a7958de9eebe9863cc3d875e8b9c52dec3f3a9992
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            assistant_installer.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\assistant_installer.exe
                                                                                                                            • Size 2.5MB
                                                                                                                            • SHA256 e86907d20a18c6b99e270a4422e0c279079e8a118b6bd7fbb4001161ddc881f4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            dbgcore.DLL
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\dbgcore.DLL
                                                                                                                            • Size 196KB
                                                                                                                            • SHA256 a2777992696c953c001dabade3f236f731987b58061efd8c894815f9939f979c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            dbghelp.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\assistant\dbghelp.dll
                                                                                                                            • Size 1.8MB
                                                                                                                            • SHA256 102419e70ed462dd1ef4a30d94b714c4317ea838d7acc85ae030dfca19f609ab
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            installer_prefs_include.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\installer_prefs_include.json
                                                                                                                            • Size 357B
                                                                                                                            • SHA256 7b25d7457665a33702d1fe62592ac331275071850d09277f705006d65b610956
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            installer_prefs_include.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\installer_prefs_include.json
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 f969b96cedf83068ce77e33cc9e7fbdc44f79e18891320b7fdaa36b1dd829349
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            installer_prefs_include.json.backup
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\305631ed-8dfd-4023-b4e0-65df55bb6b78 Opera GX Installer Temp\opera_package_202607090013491\installer_prefs_include.json.backup
                                                                                                                            • Size 342B
                                                                                                                            • SHA256 666a3a3ea1c833b6f0d993a1c13ac9b2d72d204c7c855048fc18d6513f5ddcff
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            77de7f87-920f-4efd-8e2a-65100a9aa27a.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\77de7f87-920f-4efd-8e2a-65100a9aa27a.tmp
                                                                                                                            • Size 2.6MB
                                                                                                                            • SHA256 71c7a508f591d1771979df4fb400556c4df21d8937e017e322ee1c4749dda428
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            installer.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7zS4480A838\installer.exe
                                                                                                                            • Size 9.1MB
                                                                                                                            • SHA256 61b958aba3bb53517a10908bb03c845104f8c7b712255b8e3308d13c1b15580e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ContentI3.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                                                                            • Size 3.8MB
                                                                                                                            • SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            a8d83e80-e47a-4145-961d-428938924329.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\a8d83e80-e47a-4145-961d-428938924329.tmp
                                                                                                                            • Size 14KB
                                                                                                                            • SHA256 f1d24a67ce5aa49b3a6a207a0c49c636f0a5b4851ce493326c76a0b78eb7c545
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Light_Neutral.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1488371632\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1738726494\CRX_INSTALL\manifest.json
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 8fb5674e49dc503b27e5959880938cd58ac16b8b1b96cb5e5274dcd88c9ea31f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            messages.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1831521471\CRX_INSTALL\_locales\en\messages.json
                                                                                                                            • Size 396B
                                                                                                                            • SHA256 1bcb4888a65788a50ed88f4bd95955d1dafdc950b5ef4609b37f42934a4bf3b9
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            messages.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1831521471\CRX_INSTALL\_locales\en\messages.json
                                                                                                                            • Size 429B
                                                                                                                            • SHA256 c6a7161359e3c4fbc4059b7209c585f9aa2306c08e6c39a3003f4b29f2ceb22d
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Light_Neutral.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1831521471\CRX_INSTALL\icons\32\Icon_Light_Neutral.png
                                                                                                                            • Size 962B
                                                                                                                            • SHA256 e8adb8a9dcca121a1853749ebef122b84a995ebf8775cd27b0dd54bab9840bd1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Light_Neutral.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1831521471\CRX_INSTALL\icons\32\Icon_Light_Neutral.png
                                                                                                                            • Size 932B
                                                                                                                            • SHA256 b8e92f9e9b9dc82799231b8d1b57091a9d0bcdd9b54615f86e8c4e4e5c9f036b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            index.html
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1831521471\CRX_INSTALL\index.html
                                                                                                                            • Size 222B
                                                                                                                            • SHA256 fd21c7ca4637b0221250a14b9fcfb6ebc3b734e659ad80151be4bc579db818f1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1831521471\CRX_INSTALL\manifest.json
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 b655477791478d7f6f560c740fcd142b504c7f3a73093031a3257abc43fd95ce
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            popup.js.LICENSE.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1831521471\CRX_INSTALL\popup.js.LICENSE.txt
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            81c46176-6726-437c-89c2-16d110618877.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1912362226\81c46176-6726-437c-89c2-16d110618877.tmp
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 9527f8a88118af8921b40c59fee22654dbf169a96d6a8febd2d0bb83363b1b4a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            favicon_opera_one.png
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_1912362226\CRX_INSTALL\favicon_opera_one.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            cos-bridge.js
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_2114643457\CRX_INSTALL\cos-bridge.js
                                                                                                                            • Size 173B
                                                                                                                            • SHA256 0c4209fe6d13d432cc0035b20f1eb58159ed23bda2417c07f9e8fed079414025
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            cos-content.js
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_2114643457\CRX_INSTALL\cos-content.js
                                                                                                                            • Size 502B
                                                                                                                            • SHA256 e3b30cd7ca6d753dcf9fe91f9c1fb4eeae7b9dc00eebf87f5f24e2316b76390f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            d0186417-59b8-494c-a501-57c856a38aa5.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_905350344\d0186417-59b8-494c-a501-57c856a38aa5.tmp
                                                                                                                            • Size 472KB
                                                                                                                            • SHA256 4b9b79291aca9c45d54ae238655f41b7a0eecb0b80fb3d172cd0b1d75e712540
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            pmservice.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\~os4AFA.tmp\pmservice.exe
                                                                                                                            • Size 4.6MB
                                                                                                                            • SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Opera GX Browser.lnk
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera GX Browser.lnk
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 2adcc96edc633b7a0c81c035e6840ed7791fbe2e48877272af8eef05e50050c5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            707f7bbad559de59.customDestinations-ms
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\707f7bbad559de59.customDestinations-ms
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 2f6542f72c31fe1fa8248776dabe5644e404e3e2dfb83c6b50112d7cfd289f4c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                                                            • Size 40B
                                                                                                                            • SHA256 f3e4530624da26ce0a09b252787e2efd60aa7c58f97764119279fbbf60deb49f
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            39e27b88-6683-4399-adcb-2fc4380f3027.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\39e27b88-6683-4399-adcb-2fc4380f3027.tmp
                                                                                                                            • Size 412B
                                                                                                                            • SHA256 0223364a8e07877704c5458607efef6fff8853bd2c0eb0f2ce76923ad47c1769
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            89e66e60-ecf7-462c-be8a-fd75c7028b35.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\89e66e60-ecf7-462c-be8a-fd75c7028b35.tmp
                                                                                                                            • Size 162KB
                                                                                                                            • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 675725c83462df2fddb13aed47a99af9fef6e2848565799316c6ed9417b4f1ad
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 48B
                                                                                                                            • SHA256 b8a62068378bc94be934f14c2935b52d32e0de6798e5ab6a351fd0a017073307
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            MANIFEST-000001
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Rules\MANIFEST-000001
                                                                                                                            • Size 41B
                                                                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            messages.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\_locales\en\messages.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 57e2b257a65fa5e980c619214ed9ae25580bbd581143e28abac49928b31977a6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            background.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\background.js
                                                                                                                            • Size 17KB
                                                                                                                            • SHA256 c7a162a7650887dffe12034ddbba5ddb91ca5bf4f5478f59ded324f7e088bacb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            twitch16.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch16.png
                                                                                                                            • Size 370B
                                                                                                                            • SHA256 6534efc770a8a32c881258029c2f2b9d9f1b75228f53bf9b4cd2b9a9689884e0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            twitch48.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch48.png
                                                                                                                            • Size 921B
                                                                                                                            • SHA256 47e37c0726206401cc69cb6ab0fdda79b364356a5e2fdbd5ce479bfbb965f245
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            main.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.5_0\main.js
                                                                                                                            • Size 47KB
                                                                                                                            • SHA256 4c2cc909a2d1ca6b84270a6329e81f0f1de229ce49fd9412033a5c45e1d2e72f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.5_0\manifest.json
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 028acb85f69bedc88c9f9ce97bf0c31615f83032d90de1b7017614a389648b71
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            favicon_opera_one.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.49.0.1_0\favicon_opera_one.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            reader_mode.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.49.0.1_0\reader_mode.js
                                                                                                                            • Size 112KB
                                                                                                                            • SHA256 2351bf9735cdb0eb1aeb738cf596ec80a063f47447c9cba68da963c644e7d0ea
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            service_worker.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.49.0.1_0\service_worker.js
                                                                                                                            • Size 74KB
                                                                                                                            • SHA256 1480798b974b29c617d9ebb4b4408f1eea9febbcde0083373cf8d178dca1b6cb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            spotify_frame_interceptor.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.49.0.1_0\spotify_frame_interceptor.js
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 efc95edf1976955e0aaad47bd2e84951c0fb06f18f8b1c09646f0c950d60d4cd
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            background.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\background.js
                                                                                                                            • Size 86KB
                                                                                                                            • SHA256 bc24cb72eda19eaf9ee195f014bd6247e826cc594e73461b826c6bd0d5f50dce
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Dark_Active.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Dark_Active.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 97d9553a4f725354a6d5c3eff11f31285fd89c3b150593f04785b83d0a56efc2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Dark_Available_Red.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Dark_Available_Red.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 9eccebdbdb61efc0cbd8bccf3a5fedc6f9a1ebe5084b160783f90a56cd1efa7b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Dark_Available_Yellow.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Dark_Available_Yellow.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 c165ef60bf3806cd0a7121a8d6cfd06909fc84b38a07d43e809bd7bff564099c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Light_Neutral.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Light_Neutral.png
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Dark_Active.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\32\Icon_Dark_Active.png
                                                                                                                            • Size 883B
                                                                                                                            • SHA256 50aa1dcfa9083b57dd6187752b2c149294210be12d263b793d27daf8d431954c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Dark_Available_Red.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\32\Icon_Dark_Available_Red.png
                                                                                                                            • Size 895B
                                                                                                                            • SHA256 2278e95b28851ade57217ab5c7b32598c44e1085693a3e26379643d29fa0a6d1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Icon_Dark_Available_Yellow.png
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\32\Icon_Dark_Available_Yellow.png
                                                                                                                            • Size 895B
                                                                                                                            • SHA256 726a50a9c008449ab7bafbf21325bfc72093b7ae6a56c5be90cf8c32a8a44641
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            rules.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\rules.json
                                                                                                                            • Size 839B
                                                                                                                            • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            computed_hashes.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_1\_metadata\computed_hashes.json
                                                                                                                            • Size 73KB
                                                                                                                            • SHA256 6981ab0e6f2328f8b6f583cee4b68ca6cb8359e800387774dac97df21043e0c4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            verified_contents.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_1\_metadata\verified_contents.json
                                                                                                                            • Size 6KB
                                                                                                                            • SHA256 7962ed372049509eb040645a6a96d37c60414647f7d7c6852d20e183d8fca45d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_1\manifest.json
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 4dc8cf07548e8abda9ccaed742ce955a4cce2b524abf4a2a73a5411c22aa567c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            MANIFEST-000001
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\IndexedDB\chrome-extension_jifbgnmbgbdiedhdecealmlgmekpagde_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                            • Size 23B
                                                                                                                            • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            315d4e2f-959f-45cc-b814-1f8389eb3a18.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\315d4e2f-959f-45cc-b814-1f8389eb3a18.tmp
                                                                                                                            • Size 27KB
                                                                                                                            • SHA256 cc914b6c8be70f233d533244b1fe41e32c495b9bb57901a96777f7d19fd75dfa
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            33812d05-fae0-4aff-9b94-c4ad59c14f88.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\33812d05-fae0-4aff-9b94-c4ad59c14f88.tmp
                                                                                                                            • Size 27KB
                                                                                                                            • SHA256 c5b282a24d9ef3ca8b9ec9a229d76f55e76c8765f3d55b13ae9d0f6501c7b0fd
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            748b7383-8bb4-47fe-9201-47c715b52803.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\748b7383-8bb4-47fe-9201-47c715b52803.tmp
                                                                                                                            • Size 27KB
                                                                                                                            • SHA256 2f1a860dec73e59307d1a8e1b1ace276076ef77008f468720569bfc8d7ba2512
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            96e4accf-4e33-4f55-9b3b-2d6a1de63169.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\96e4accf-4e33-4f55-9b3b-2d6a1de63169.tmp
                                                                                                                            • Size 27KB
                                                                                                                            • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            d3b20794-2cbe-47ef-9c54-d8674e1d3039.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\d3b20794-2cbe-47ef-9c54-d8674e1d3039.tmp
                                                                                                                            • Size 27KB
                                                                                                                            • SHA256 b79b047aa13202f575c92b513e67530ee9a5de4755d8d67c85c2f156c9a4eb39
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            8543d00c-d10f-44ad-ae8c-991a9ee48e95.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\8543d00c-d10f-44ad-ae8c-991a9ee48e95.tmp
                                                                                                                            • Size 59B
                                                                                                                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Network Persistent State
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 0adc262230ca27ef0d1765847f66c5f6217442123bf1a6c6538536c0ae2106f2
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 c4ef4a8e060caa5d9f60d53cd210ae4273305b31ea0f53d0bf0791b0de04c7f0
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 b1fe053480b7e95520e80729868e15a0987ad389cc4d81b05ac8889aeaa612aa
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 9a1e792dcaf7a464e4b99cb56e201f827735428e8fffe4140f872ae85f2fe7a9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                                                                                                            • Size 214KB
                                                                                                                            • SHA256 f528a60331ba1ae6b90ce304504c66a87b66b8f2ad5e5d36ddfcfd9410cfa6c5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            03dc1a8e-42fa-4dbd-93c6-ad8fcb0be196.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\03dc1a8e-42fa-4dbd-93c6-ad8fcb0be196.tmp
                                                                                                                            • Size 72B
                                                                                                                            • SHA256 d772f9e76b533e329f576aa78284e67a45fe2b8b91b28de3020e46924649812a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                            • Size 456B
                                                                                                                            • SHA256 5c5a640d8ffd41035881384f6f58ec8a4ce3f6bf8662ee2749646d66665946d3
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                            • Size 456B
                                                                                                                            • SHA256 0fc3126bcb41bf215efc7dad9a36fbabe1edccaa087118e7fe29fde8657c5489
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            2731d6e1-a26d-4953-8222-7d0bdc610f52.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\2731d6e1-a26d-4953-8222-7d0bdc610f52.tmp
                                                                                                                            • Size 429B
                                                                                                                            • SHA256 476a2a77081cabb4be9f3c808c211ff8bbde09246368f04ea918ec19fa50e12f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            f544110d-f687-4baa-b8a1-235c40a48962.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\f544110d-f687-4baa-b8a1-235c40a48962.tmp
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 dba22b529ef1d5c3831841c27a08f4edc046950ffe38283d8c64b4cd131afa23
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 5a7d7ec758ae1dc6610722951efdedb9efd09372ccee62fe4be82bfc1c85fc6d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 acd5e68569c2cc2f1ed3833f47a7c22276c30be1294c9a334c2bdf8895aebbdf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 9bef81c6509e5e9324fef5587d6446114ab8df0e0beac450e7623c39b526eded
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 5cc171f34b9b1136368b1d7c893eaf07b8b7f09a860752f2037582498059ab58
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 b076a4e106d6fb25d0247f5e6308d6ffb0007084c00dfe0ca1f97ff16109f2c5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 96cbcb0bb0d6d88f29e6dd3d03540a37197bf2a9ec0d8a469650d00a4949e378
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 622f8bee02da5802e3a197b4da740af28690c970f4c086a6aec8df9d1d3b713d
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 7c4d14fcdd6050b37441bfb0fa3357b09af4703815fc6cdb1132c13ff01b5108
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 696f6822b5941e3975e08f0c41262e003804e52faa573dc62b88c21fe98f8aeb
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 df837edaa1fef58564ec5e319e00c554fe5d42ea4a02ad9a75d23e9daf6e5402
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 bed1e68870e748d991b07edb65472ae030b167090b266b104dc373f064f9c553
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 9b6d8cbc8dd3fa4912880efa66850f5dde0e8b4c75f34586982dea34855b5564
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 37c3da7bfb671fc54a56de8d9a313ba785f33ce4248e1ff2a62cad6b7a5617d8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 a7fda1be7c493bb78c8aa6abb0bdc1497a4c5bcadd83177adf88d14777eb454a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 624b6cea2e71efa34c93f8f9755a8e959696678f1276ca09b76ee27525e4220c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 be4bcbcf90ad2c8c41342e3a73cb49351e3e9c236ae5472c25395bba7364b886
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 765cf411b24f1ae9b0baae1ee8aee408ef93b51ecc991d7e90eafccde834f5b4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 541B
                                                                                                                            • SHA256 04d1cf07cb5880c1aa1eaf7e9107365672c282c6aaa6f2a581ada0ac03823e62
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 653B
                                                                                                                            • SHA256 6d1b705627799077918995a98eb1c6021f0841ffb192105b5361160c7225fa58
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 781B
                                                                                                                            • SHA256 d2c2d5520f479c7716375b4b31d64c5c8ec973e3060ab024edb9b94bcba0845e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 957B
                                                                                                                            • SHA256 1a225911610eab8cb73a2dd4d6e2303eed97cbef6924db48ea559e71eec27ba1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 286be10c23fb1d2622e0404518be5342da74a6f88ce6dca5fe63ac1d7a9c84aa
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 409e11aa1fc7cc1113ae7ee7ee44abafaec7dad535efa082a956c43195642032
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 b45406f9832fedd399e858c6337aac36a76da21c0795a2eb0e3f0b0f126364a0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 29f4e848677e30c4bf0a24e2a6fe6e6e1f99dd2816b2a663421347e90e213daa
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 e47e5bf457f707ef65e6e3a89d34c95dfeaccc0bad9cd8d1f8c00bdf87880505
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 39114bec19222e72604a7fa80765a31a03ec7a53b3bbd55e72b0171edd54f18f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 573bb0367cdc364220abba5f8e24068e96352fabb4714bab08ee87e4b0326410
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 6a4249d23b44539959c93ea9b80dd7f776ecfd39ef7888bb689e21c8b46b5c6a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 25d88f83292390b2896d65063b740ae05627e8816da3d220336d020871123f07
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 d0951fc3296ca86ff994ba5d2e71c81132eabbf32b571ed835f8b4f6e0eaaa23
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 90bb73d753a526f3242fefb26b6c46d026460c42cae92275dd22d79a5289d2cb
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 3b1b87ece804d863784862931e4e4213f022db885ba9780b363cbe4963753917
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 3d94a5cc7940d61fc1c1582144eae2f270cb17289f7679dccb4adfa2b2ad91e3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 ac2b2cb676aa393eb9458589e2e5344f9b7ede653aa9824ab8719ab707426706
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 248034a86f82bfdf7020f5d92c793c3f73725680add3e3ffb353ab091ddd321f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 b5b0910d687ac4363007cba5c6d5bdde8bfedba415a253152884c2f20cd2ceb5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 fce9ecf43c5513e556c442306563c3dcb825a638bef12cb017817153c5257e06
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 22136c75e6bad3593b49335cb9d2ad49f92798b0f8eba2fcca7ceab477a045b3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 689608bd4c909abc1c22dc3ddce318a504c93c09b2352324777b02e61fcdbac3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 2d742b8402053fc220ab23ca5f159fadc653ce85a87f6335a6175dbf81f1fadb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 b0ac45be0750518d40e68217da991df889af19741fdb104538627fc1e0165359
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 c1985d8527c639b7fc77fc2866fb2f57c0189e94e814ec9a764418c1d51dead5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 ffbcf1930a6d183d28698ef61da0e8537629d17ff98a3da141b12d74c14abea7
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 e072c2b2d3eded655231e155a7b13582c7ce114d258f95fc9daab2d703dd3429
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 f533ac2e52ce2b45a5fb793fd9f3c549e9b75a3c16a6a16c392cef982e8ec756
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 a240661d47022f949f0df97a2b3e638e08beb2d6de5f36b7f45a83ffd09e7185
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 c2774a61e16d954aec1954604a22f2e301ceee4216a6e987c7e21b76b7ca24bf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 bdf26d6feab547c49ef2bf2a07edbeb6902874944449bdb9be41f1c1eea182f5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 4b510bd4cedf4ae75c4ea6cf784c4206522f4c4107eb8036993755987fcccc3d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 dd5d2813837b0e32fb72db35dd8867534c10f4ef5afc723093021e20be7830bf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 4aaba9ddf7ab9764de6c5ede075034ead21675cbc64b64e799ce4bb6855679c8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 5e6e87c8b5ac115906772bc1f6733dac0ee1166a7e6dbfe581a5f644b87bd6a2
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 7e1cf5be1e3a20c8aad0d2198c064b985d8c21a9f244477a9ec4ad6abc72123f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 9814507bb782dc717fb10b69cdfa1445b5298d8cd4c1d6824130e4d9ba8a2f46
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 3faec5b15f57f130864f90a8f20863a6f123f5da0f9265f349d8af0bae41bcd1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 f49e28285a58f4ef4d27b7e88682131798c9ff2f7b975ea6d08cfcff9e0414f6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 43df9ce1c6156cc79e1da7d5fe117309b93668c5b2eb02f4eb0945ecfea1534f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 1b70064761093c970247b910e99e5cf9cbf5773a92d5be3011de6e2d7a2690b4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 aedfba5383c5ced4885166c5cfe911c3f541448c8cde426de411788de7573c9e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 f4a52dcdeb7ce2c180f66cb536151d70a90f077b2f2bfc4589777fdac3c42131
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 2fddadc6a18c58e252a19194e97a85b1d912513734fefe23e5686f01e120caee
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 b02fdcf119fa51a63259d5b894a6bdfdae6aa29d6524aae9802f4d53a8bcbbb4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_0dc9f887-177f-46f0-9c72-c0631caf5ad5.raw
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 8ef85d678b964e6fc9d827f8aa45c01a40129729607273518c47a0bffbb7b85e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            000001.dbtmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Sync Data\LevelDB\000001.dbtmp
                                                                                                                            • Size 16B
                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            a92b4964-8d87-4b45-b112-318012513d09.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\a92b4964-8d87-4b45-b112-318012513d09.tmp
                                                                                                                            • Size 171B
                                                                                                                            • SHA256 5a67a8b8373978d41dc0f28c28fefab58b379362406aa54730a18cbc58bb8e93
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            b204c3c0-6756-4718-87b4-e865dcabf713.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\b204c3c0-6756-4718-87b4-e865dcabf713.tmp
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 65eb5cc68cf8b769f7ddeb1c1be89e01e840c5484d1fb8aef6f3a2b9a22dbdb9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            cf66ff7a-da12-46de-b046-a465db9621ea.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\cf66ff7a-da12-46de-b046-a465db9621ea.tmp
                                                                                                                            • Size 86KB
                                                                                                                            • SHA256 24633ae3c1d0fff28614cdbcb6e288a13d18991faff7dcf4c8308384df475698
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            f765686b-d940-4889-8d71-0ed5b88d5a43.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\f765686b-d940-4889-8d71-0ed5b88d5a43.tmp
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 1cdc6e2c3cf27e464c7460d107b9eafe2fcf165be62f6064aa0b1c16e1c26ca4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 09a3d6b111105075a707f0f6d661de35cbbb60e9cc8627c81ff81df090c40be8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 597B
                                                                                                                            • SHA256 9b727e94df279d2a0088451e9a9d268156a92ca55988325d8c55fd52422bf8cb
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 779B
                                                                                                                            • SHA256 6f8b8df3ec2a44a7d30d0fa20118963d97666f9119aa6d9246c26c4ae446fc5a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 970B
                                                                                                                            • SHA256 6b80f0d408cc742fb82d8f62804201968259c3f6e0e498d1d63485345764f6fe
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 a86524b3eba50f5575f76c5df889a86c294694cf3a4e848c4a2a3bc41bfbec03
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 505B
                                                                                                                            • SHA256 dd83fc4574b5d4f01c43faa1187a7a0e0b0e81f6d23a88df2d896a180d16e5e0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 690B
                                                                                                                            • SHA256 41e8e44f11d7097fecf6e2f12b8a83ce6d3afdbb8910fe12ba4b6669b64ef6a6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 d6490eb38f65708f56e69bbc5e9d314b24e5dc3ee2097f6f0a3be3d6a7d4d0f8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 870B
                                                                                                                            • SHA256 d21ae127f8972a08794669fa6712d16177666c4d08eb81787ca35a57dd35a9c9
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 9db54a2bb7fea1d366a9747f0fab536efcd2e9f482e235190648feb6589f8061
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 9b3a7cbbed168f173e27050d49f01e56fa0569ec7bc4f8b21719f691c209b936
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 522d370c066c021d5c6b4fb8fffe45d7121ff5d664931c17598f84417dbd7144
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 c0ce14300047b788fd5daf88a52c9bd834a04a5c8ea57cfaa4908af7fa0a0fcc
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 9dd131645a4caed00613a689288e48436a22113e82be964baba87488bf182b0a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 add58360cd76c3c80d8f1e5e9a63b90d6fa3b06343f7053a6734d2486d8ac7f8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 a02eeceb788d74649e0b9f2e2633be7447b010915422364223c008c1c4f813cf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 232674ad8cd46110a011c136e1a44c8069a4a6fc308fa7f40a4254fec08fe560
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 27ad64539ac1b3e3a533a85e9a16bb7f03b46e160a86cea4f546d3b71ef88f28
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 3cebcbc9fee136fa597cdf31d15e3134849e3372e3f765129c09d3af1018009f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 4be8a6c54303e27811295659bfbb2ff6cf9a04ac51ae88f6b20009340f7bf147
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 9de08cba937a884764a9b50c96ef9c0474b2940d7ba46323b7620da369693886
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.0.1505541867
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.0.1505541867
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 19a90ad669c291d785e36dc398d29c922198c0ff08d761a6d267d01cd29b0f9e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.1.116918504
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.1.116918504
                                                                                                                            • Size 224B
                                                                                                                            • SHA256 c877427fec4fa075ae185b795947948cf36d7f90efc37108c0b663a058a09ae7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.1.116918504
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.1.116918504
                                                                                                                            • Size 200B
                                                                                                                            • SHA256 7cfa2559f31afdebf791bb36e49fd4043096e88d8584e859372ccb9785a89dab
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.1.116918504
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.1.116918504
                                                                                                                            • Size 224B
                                                                                                                            • SHA256 34d2d6649c21470f6c2cbf372056f07f041e9b1e45fc4a467dcffe162e8b7ba3
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ssdfp1780.1.116918504
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1780.1.116918504
                                                                                                                            • Size 224B
                                                                                                                            • SHA256 f8c8d88dc1875c1bc4c3f0f9fcdbd1e5eb3acba1b75811116fe0ab0c48070edf
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            data_0
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            data_2
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            data_3
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            data_1
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_1
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 614666664b2604d3adb4b21c9dc96352cd435379f1e8d70f083273c1866d6263
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ByteBreaker V2_55241264.exe
                                                                                                                            • Path C:\Users\Admin\Downloads\ByteBreaker V2_55241264.exe
                                                                                                                            • Size 702KB
                                                                                                                            • SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ByteBreaker V2_55241264.exe:Zone.Identifier
                                                                                                                            • Path C:\Users\Admin\Downloads\ByteBreaker V2_55241264.exe:Zone.Identifier
                                                                                                                            • Size 208B
                                                                                                                            • SHA256 2fded2dae02e902a687aa0afbd56642c9d26a1ff336404693d9c01d89b6620e7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            REG4FDB.tmp
                                                                                                                            • Path C:\Windows\SystemTemp\REG4FDB.tmp
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 888c17500aa628b5ad67722aa766e0dd5042513efafda97fc69750329b6aed3e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            hyph-as.hyb
                                                                                                                            • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping1780_676526012\hyph-as.hyb
                                                                                                                            • Size 703B
                                                                                                                            • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            hyph-hi.hyb
                                                                                                                            • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping1780_676526012\hyph-hi.hyb
                                                                                                                            • Size 687B
                                                                                                                            • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            hyph-nb.hyb
                                                                                                                            • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping1780_676526012\hyph-nb.hyb
                                                                                                                            • Size 141KB
                                                                                                                            • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping1780_676526012\manifest.json
                                                                                                                            • Size 82B
                                                                                                                            • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/1780-3670-0x00007FFA3CC40000-0x00007FFA3D3EE000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1780-3668-0x00007FFA3D7F0000-0x00007FFA3D8AD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1780-3672-0x00007FFA295C0000-0x00007FFA29ABA000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1780-3671-0x00007FFA34830000-0x00007FFA3493C000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1780-3669-0x00007FFA3BB80000-0x00007FFA3BEF4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2824-376-0x0000019132670000-0x0000019132DDD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2824-346-0x0000019132670000-0x0000019132DDD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2824-3618-0x0000019132670000-0x0000019132DDD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2824-3667-0x0000019132670000-0x0000019132DDD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2824-683-0x0000019132670000-0x0000019132DDD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2824-411-0x0000019132670000-0x0000019132DDD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5508-738-0x00007FFA3DA90000-0x00007FFA3DA91000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5508-736-0x00007FFA3C6A0000-0x00007FFA3C6A1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3556-0x00007FFA34830000-0x00007FFA3493C000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3558-0x00007FFA3CC40000-0x00007FFA3D3EE000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3557-0x00007FFA3AD10000-0x00007FFA3AD52000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3555-0x00007FFA3AF20000-0x00007FFA3AF87000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3554-0x00007FFA295C0000-0x00007FFA29ABA000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3551-0x00007FFA3BB80000-0x00007FFA3BEF4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3552-0x00007FFA3D780000-0x00007FFA3D7EF000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6916-3550-0x00007FFA3D7F0000-0x00007FFA3D8AD000-memory.dmp
                                                                                                                            Download