20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Resubmissions

06/08/2026, 19:43

260806-ye9spshp218

06/08/2026, 19:41

260806-yejarazamf8

Analysis

user interaction
yes
max time kernel
227s
max time network
211s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260806-ye9spshp21
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
23	1296	installer.exe
11	4632	OperaInstaller.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
52	OpInst.exe
1296	installer.exe
3888	installer.exe
5824	installer.exe
1528	installer.exe
636	installer.exe
5480	Assistant_130.0.5847.41_Setup.exe_sfx.exe
5908	assistant_installer.exe
2560	assistant_installer.exe
2496	installer.exe
1928	installer.exe
1056	opera.exe
1264	opera_crashreporter.exe
2736	opera.exe
2648	opera.exe
3584	opera.exe
3928	opera.exe
3128	opera.exe
4216	opera.exe
2720	opera.exe
4888	opera.exe
3608	opera.exe
4172	opera_crashreporter.exe
5056	opera.exe
5044	opera.exe
6656	opera.exe
6676	opera_crashreporter.exe
6860	opera.exe
6912	opera.exe
6868	opera.exe
7164	opera.exe
7156	opera.exe
6304	opera.exe
2620	opera.exe
4080	opera.exe
1844	opera.exe
6160	opera.exe
6252	opera.exe
6320	opera_crashreporter.exe
1492	opera.exe
1292	opera.exe
1412	opera.exe
5688	opera.exe
6456	opera.exe
2252	opera.exe
4516	opera.exe
6400	opera.exe
5012	opera.exe
4688	opera.exe
4776	opera.exe
5276	opera_gx_splash.exe
6980	opera.exe
7064	opera.exe
6284	opera.exe
6308	opera.exe
2844	opera.exe
6884	opera.exe
6160	opera.exe
560	opera.exe
4896	opera.exe
4684	opera.exe
848	opera.exe
6968	opera.exe
5528	opera.exe

Loads dropped DLL 64 IoCs

pid	Process
5908	assistant_installer.exe
5908	assistant_installer.exe
2560	assistant_installer.exe
2560	assistant_installer.exe
1056	opera.exe
1056	opera.exe
2648	opera.exe
2648	opera.exe
2736	opera.exe
2736	opera.exe
3584	opera.exe
3584	opera.exe
3928	opera.exe
3928	opera.exe
3128	opera.exe
3128	opera.exe
4216	opera.exe
4216	opera.exe
2648	opera.exe
2720	opera.exe
2720	opera.exe
4888	opera.exe
4888	opera.exe
2648	opera.exe
2648	opera.exe
2648	opera.exe
2648	opera.exe
3608	opera.exe
3608	opera.exe
5056	opera.exe
5056	opera.exe
5044	opera.exe
5044	opera.exe
6656	opera.exe
6656	opera.exe
6860	opera.exe
6860	opera.exe
6912	opera.exe
6912	opera.exe
6868	opera.exe
6868	opera.exe
7156	opera.exe
7164	opera.exe
7156	opera.exe
7164	opera.exe
6868	opera.exe
6868	opera.exe
6868	opera.exe
6868	opera.exe
6868	opera.exe
6304	opera.exe
6304	opera.exe
2620	opera.exe
2620	opera.exe
4080	opera.exe
6160	opera.exe
6160	opera.exe
4080	opera.exe
1844	opera.exe
1844	opera.exe
6252	opera.exe
6252	opera.exe
1492	opera.exe
1492	opera.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-et.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-en-gb.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-de-ch-1901.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_463521999\_metadata\verified_contents.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-ta.hyb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir6656_618710402\opera-one.jpg	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-mr.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-hi.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-eu.hyb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir1056_1360322504\opera-one.jpg	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir6252_2104040122\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-pa.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\_metadata\verified_contents.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-sv.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-nl.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-ka.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-cs.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-te.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-gu.hyb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir1056_1536349312\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir6656_595334646\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir6252_796581255\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-or.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-ml.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-da.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-cy.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-be.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-und-ethi.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-pt.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-ga.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_774731419\_metadata\verified_contents.json	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir1056_1360322504\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-it.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_463521999\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-uk.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-ru.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-hu.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-en-us.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-as.hyb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir6656_595334646\opera-one-dark.jpg	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-sq.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-nn.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-la.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-kn.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-cu.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_463521999\preloaded_data.pb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir1056_1536349312\opera-one-dark.jpg	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir6656_618710402\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir6252_796581255\opera-one.jpg	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-sl.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-mul-ethi.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-lv.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-es.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-tk.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-mn-cyrl.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-gl.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-el.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-bg.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-af.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_774731419\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-hr.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-fr.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6252_443985941\hyph-de-1901.hyb	opera.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1492	opera.exe
2736	opera.exe
6860	opera.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera_autoupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe

Modifies registry class 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.xht	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Applications\opera.exe\shell\open\command	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Applications\opera.exe\shell	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\ddeexec\Application	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\ddeexec\Topic\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.opdownload	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.htm\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.xhtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Applications\opera.exe	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.pdf	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe,0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\command	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.htm\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.shtml\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Applications\opera.exe\shell\open	installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{0801E308-AA0D-42DD-A78E-CC1658EBCAB2}	opera_gx_splash.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" -noautoupdate -- \"%1\""	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.opdownload\OpenWithProgIDs\OperaStable = "0"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.pdf\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Applications	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\ddeexec	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\ddeexec\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\ddeexec\Topic	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\FriendlyTypeName = "Opera Web Document"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.pdf\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.shtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.xht\OpenWithProgIDs	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open\ddeexec\Application\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.shtml	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.xhtml\OpenWithProgIDs\OperaStable = "0"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Applications\opera.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" \"%1\""	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\134.0.5954.46\\notification_helper.exe\""	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\134.0.5954.46\\notification_helper.exe"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.html\OpenWithProgIDs\OperaStable = "0"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\URL Protocol	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\shell\open	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.opdownload\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.htm	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.html\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.xht\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.xhtml	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\OperaStable\DefaultIcon	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.html	installer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6252	opera.exe
6252	opera.exe
7028	opera.exe
7028	opera.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1056	opera.exe
1056	opera.exe
1056	opera.exe
6656	opera.exe
6656	opera.exe
6656	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe
6252	opera.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1056	opera.exe
Token: SeCreatePagefilePrivilege	1056	opera.exe
Token: SeShutdownPrivilege	1056	opera.exe
Token: SeCreatePagefilePrivilege	1056	opera.exe
Token: SeShutdownPrivilege	6656	opera.exe
Token: SeCreatePagefilePrivilege	6656	opera.exe
Token: SeShutdownPrivilege	5276	opera_gx_splash.exe
Token: SeCreatePagefilePrivilege	5276	opera_gx_splash.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe
Token: SeShutdownPrivilege	6252	opera.exe
Token: SeCreatePagefilePrivilege	6252	opera.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 52	4632	OperaInstaller.exe	89
PID 52 wrote to memory of 1296	52	OpInst.exe	90
PID 1296 wrote to memory of 3888	1296	installer.exe	91
PID 1296 wrote to memory of 5824	1296	installer.exe	92
PID 1296 wrote to memory of 1528	1296	installer.exe	93
PID 1528 wrote to memory of 636	1528	installer.exe	94
PID 1296 wrote to memory of 5480	1296	installer.exe	96
PID 1296 wrote to memory of 5908	1296	installer.exe	97
PID 5908 wrote to memory of 2560	5908	assistant_installer.exe	98
PID 1528 wrote to memory of 2496	1528	installer.exe	99
PID 2496 wrote to memory of 1928	2496	installer.exe	100
PID 2496 wrote to memory of 1056	2496	installer.exe	101
PID 1056 wrote to memory of 1264	1056	opera.exe	104
PID 1056 wrote to memory of 2648	1056	opera.exe	105
PID 1056 wrote to memory of 2736	1056	opera.exe	106
PID 1056 wrote to memory of 3584	1056	opera.exe	107
PID 1056 wrote to memory of 3928	1056	opera.exe	108
PID 1056 wrote to memory of 3128	1056	opera.exe	109
PID 1056 wrote to memory of 4216	1056	opera.exe	110
PID 1056 wrote to memory of 5056	1056	opera.exe	111
PID 1056 wrote to memory of 2720	1056	opera.exe	112
PID 1056 wrote to memory of 4888	1056	opera.exe	114
PID 3608 wrote to memory of 4172	3608	opera.exe	116
PID 1056 wrote to memory of 5044	1056	opera.exe	117
PID 2496 wrote to memory of 6656	2496	installer.exe	118
PID 6656 wrote to memory of 6676	6656	opera.exe	119
PID 6656 wrote to memory of 6860	6656	opera.exe	120
PID 6656 wrote to memory of 6912	6656	opera.exe	122
PID 6656 wrote to memory of 6868	6656	opera.exe	121
PID 6656 wrote to memory of 7164	6656	opera.exe	123
PID 6656 wrote to memory of 7156	6656	opera.exe	124
PID 6656 wrote to memory of 4080	6656	opera.exe	125
PID 6656 wrote to memory of 1844	6656	opera.exe	126
PID 6656 wrote to memory of 6304	6656	opera.exe	127
PID 6656 wrote to memory of 2620	6656	opera.exe	128
PID 6656 wrote to memory of 6160	6656	opera.exe	153
PID 2496 wrote to memory of 6252	2496	installer.exe	130
PID 6252 wrote to memory of 6320	6252	opera.exe	131
PID 6252 wrote to memory of 1292	6252	opera.exe	132
PID 6252 wrote to memory of 1492	6252	opera.exe	133
PID 6252 wrote to memory of 1412	6252	opera.exe	134
PID 6252 wrote to memory of 5688	6252	opera.exe	194
PID 6252 wrote to memory of 6456	6252	opera.exe	136
PID 6252 wrote to memory of 2252	6252	opera.exe	137
PID 6252 wrote to memory of 4516	6252	opera.exe	138
PID 6252 wrote to memory of 6400	6252	opera.exe	139
PID 6252 wrote to memory of 5012	6252	opera.exe	140
PID 6252 wrote to memory of 4688	6252	opera.exe	141
PID 6252 wrote to memory of 4776	6252	opera.exe	142
PID 6252 wrote to memory of 5276	6252	opera.exe	183
PID 6252 wrote to memory of 6980	6252	opera.exe	145
PID 6252 wrote to memory of 7064	6252	opera.exe	146
PID 6252 wrote to memory of 6284	6252	opera.exe	147
PID 6252 wrote to memory of 6308	6252	opera.exe	148
PID 6252 wrote to memory of 2844	6252	opera.exe	149
PID 6252 wrote to memory of 5292	6252	opera.exe	150
PID 6252 wrote to memory of 7128	6252	opera.exe	151
PID 6252 wrote to memory of 6884	6252	opera.exe	152
PID 6252 wrote to memory of 6160	6252	opera.exe	153
PID 6252 wrote to memory of 560	6252	opera.exe	154
PID 6252 wrote to memory of 4896	6252	opera.exe	156
PID 6252 wrote to memory of 4684	6252	opera.exe	157
PID 6252 wrote to memory of 848	6252	opera.exe	158
PID 6252 wrote to memory of 5536	6252	opera.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=YzM3YjQ4ZjBkNjQwMmYwOGNhMjRmY2E0YmNlMjAzZjAyOGQ2Y2NiZTUzZjRlOGExYzdmOTQxYzM2NzJiMGYzYjp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5LWNsdWIiLCJ0aW1lc3RhbXAiOiIxNzg2MDQ1NDE3LjQ1NzAiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeS1jbHViIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJ3cmsifSwidXVpZCI6IjA3MzQ5ZTE1LThlMjEtNGE0Yy05MWVkLTIwMjI4NGZiZGQ2MCJ9
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x294,0x290,0x2bc,0x298,0x2c0,0x7ff7328fad88,0x7ff7328fad94,0x7ff7328fada0
      4⤵
      Executes dropped EXE
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1296 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_20260806154338" --session-guid=b117ed86-a829-4d91-a168-fc35b5a1fc5b --server-tracking-blob="ZTU0NDY0YzgwYzgxNGUzMzZlOTQ3MzU2YzhhMDBjZmU0Zjg2ZTIyODE5OWJlMGNmZGI5Njk3YzM4Mjg3ZDgzZDp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5LWNsdWIiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3ODYwNDU0MTcuNDU3MCIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJzcG90aWZ5LWNsdWIiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMDczNDllMTUtOGUyMS00YTRjLTkxZWQtMjAyMjg0ZmJkZDYwIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0808000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x2c0,0x2c4,0x2c8,0x298,0x2cc,0x7ff7328fad88,0x7ff7328fad94,0x7ff7328fada0
        5⤵
        Executes dropped EXE
        
        PID:636
    - - C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe" --backend --initial-pid=1296 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381" --session-guid=b117ed86-a829-4d91-a168-fc35b5a1fc5b --server-tracking-blob="ZTU0NDY0YzgwYzgxNGUzMzZlOTQ3MzU2YzhhMDBjZmU0Zjg2ZTIyODE5OWJlMGNmZGI5Njk3YzM4Mjg3ZDgzZDp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5LWNsdWIiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3ODYwNDU0MTcuNDU3MCIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJzcG90aWZ5LWNsdWIiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMDczNDllMTUtOGUyMS00YTRjLTkxZWQtMjAyMjg0ZmJkZDYwIn0= " --silent --desktopshortcut=1 --install-subfolder=134.0.5954.46
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x7ff6c703ad88,0x7ff6c703ad94,0x7ff6c703ada0
        6⤵
        Executes dropped EXE
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\de932af914ba00303d4a2778a383ac9c831101e2.crx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Checks processor information in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ffdd50bf0d0,0x7ffdd50bf0e0,0x7ffdd50bf0f0
        7⤵
        Executes dropped EXE
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1640,i,9267997749796080525,7208744936952351621,262144 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2036 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1940,i,7245241025305934236,6100363525091277943,524288 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2104 /prefetch:11
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        Enumerates system info in registry
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2496,i,979604039384821887,3693609925729993347,524288 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2704 /prefetch:13
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3852,i,3241235790937504453,12022580835896441319,2097152 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3896 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4072,i,17535746075013901435,4894184095952047515,524288 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4160 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4092,i,17659737422034862008,13572757181626058650,2097152 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4064 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4588,i,744336231973982996,1156490586427935815,2097152 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4648 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4120,i,11144249566381333667,12210735888091032301,524288 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4048 /prefetch:12
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3888,i,13369163604551954535,11162975669472008043,524288 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5076 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5268,i,13606816895876208669,11443946990994546635,524288 --field-trial-handle=2040,i,9368220764336040052,2132736894783042142,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16001534365443635733,3295419177442439088,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4164 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\additional_file2.tmp"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ffdd50bf0d0,0x7ffdd50bf0e0,0x7ffdd50bf0f0
        7⤵
        Executes dropped EXE
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1916,i,114081465702724970,17007185025545362440,524288 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2148 /prefetch:11
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1724,i,12163176545688921153,15412094043159050898,262144 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2112 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2428,i,10939065867059101482,2535935408395139022,524288 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2288 /prefetch:13
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3848,i,13544537831998660060,17332849638688429233,2097152 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3932 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3812,i,10540960714731297077,17353082978601514722,524288 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3900 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3996,i,9100620897232586992,17725369527208322898,2097152 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4204 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4248,i,17330280422521990429,3756070822942772448,2097152 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4380 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4956,i,1156890317890521611,14114377234705805744,524288 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4940 /prefetch:12
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3796,i,18397357862274057734,16999928350658749665,524288 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5076 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5060,i,8010448668509652677,12715505675412879387,524288 --field-trial-handle=2116,i,5389983835887003566,3913622163435108379,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2120,i,14896892364244190748,14199132326497020857,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5228 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ffdd50bf0d0,0x7ffdd50bf0e0,0x7ffdd50bf0f0
        7⤵
        Executes dropped EXE
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1724,i,2708756594909552402,3903204156567308685,262144 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2132 /prefetch:2
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1928,i,3564661667042083248,4728857120803645194,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2232 /prefetch:11
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2496,i,16875138621236111196,5062445390549286968,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2720 /prefetch:13
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3212,i,11199892276187261058,11679755091923705056,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3316 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3224,i,6499368098405784547,14851227851985980655,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3336 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3236,i,18282436312760341157,3316970130695389233,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3356 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3248,i,7330177624435012600,12880408514118130354,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3376 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3172,i,1250617679813239645,10556803538101850683,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3260 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3268,i,6536054500844266598,14969200718069153851,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3396 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3200,i,2052502121753905849,17155965755565012337,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3296 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3908,i,7095824465097542819,3953394510992454324,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3992 /prefetch:1
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_gx_splash.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C96
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4712,i,16105592467398171889,8602487641917217151,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4720 /prefetch:9
        7⤵
        Executes dropped EXE
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4872,i,10435229781410558047,16557963743950230994,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4892 /prefetch:1
        7⤵
        Executes dropped EXE
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5148,i,3034849285201730603,14522724979179096209,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5192 /prefetch:1
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5320,i,11698873548713211740,17706641712375772380,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5332 /prefetch:1
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6188,i,8483883143074787513,16343406706687711762,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6312 /prefetch:9
        7⤵
        Executes dropped EXE
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6512,i,11576624262615962241,6797822147986926493,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6872 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6804,i,5239733209143349535,13553962266413108270,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6896 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7248,i,11929247405830003712,12021514738645295159,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6596 /prefetch:12
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7280,i,10395123966578267141,16784056352607473250,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7340 /prefetch:1
        7⤵
        Executes dropped EXE
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7464,i,6049901051544618820,1956369108257932900,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7492 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7620,i,18103193411652402246,4246827605346836370,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7676 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7604,i,14320315702644267015,14546073451751712286,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7796 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7260,i,12109075195680566092,13988192505439482817,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7712 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7284,i,15622365228943042354,4651459635692982926,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7776 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7656,i,4355447016778915350,11901579802201859701,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7804 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7316,i,9126785809299031975,10121306303577148453,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7736 /prefetch:14
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7276,i,13131236547405899341,15971275212176228015,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7756 /prefetch:14
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7272,i,6631088554893012951,17442087633713276371,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7692 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8728,i,5393126108535621636,14550797294378129813,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8760 /prefetch:14
        7⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8692,i,18248139724577605503,7058805696028011183,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8780 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8748,i,17980613514469578304,11273297579797825044,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8868 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8736,i,9030753888307970987,11384587405028044311,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8820 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8700,i,6923907643283822612,939668062084945134,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8800 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9524,i,6913589715824366713,1861581309540446327,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9536 /prefetch:14
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
        7⤵
        Enumerates system info in registry
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff6883948d0,0x7ff6883948dc,0x7ff6883948e8
        8⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=4512,i,11860011234396608460,13691139176049548847,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9752 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9720,i,4625395690947645913,17790527793727847167,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10216 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10340,i,3167190510379031740,15151365230420276924,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10228 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10516,i,16352254744015392548,14923671196005350842,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10528 /prefetch:14
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10776,i,13656747455945352587,12787568659423725031,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10784 /prefetch:14
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11008,i,17699577496208900337,6624959439773553159,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=11024 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11016,i,7554907025347046584,6213685679913647021,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11044 /prefetch:14
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9680,i,2138611950689803407,9275250484205916090,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11320 /prefetch:14
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=11492,i,15889175073947433479,17078185051260067456,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11504 /prefetch:1
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7304,i,8869286836718917250,1079462904049213389,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=3348 /prefetch:14
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3340,i,13327028699143449406,17404091679006677540,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=7492 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10832,i,5384192305324835535,14119519055107718083,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11336 /prefetch:14
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7528,i,16560666840062764590,2019649148998696089,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=7504 /prefetch:9
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8660,i,4109741260739304594,7582958958569885624,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=8636 /prefetch:14
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8268,i,2638817814783602036,8142303899414962699,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=3380 /prefetch:14
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8596,i,1444536877334566241,1375552396539076931,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=3204 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8612,i,7288618924661443574,12559072498437589963,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=7680 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7272,i,11190687539342855688,17060859545398552610,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=8672 /prefetch:14
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7612,i,14964272427266386086,3925458618068089249,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=3384 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=3728,i,9655740977384181946,12896673261157856183,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=8604 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8260,i,6990035053115970190,5993566307442044727,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=11760 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5516,i,11715355143112424262,9574672643667616924,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=3204 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=11732,i,5595487416529617212,16767015562526081478,262144 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=10976 /prefetch:10
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=860,i,530554190860727108,8558324361431139670,2097152 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=7124 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:detect-sections-in-search=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:extension-permission-update=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:make-opera-yours-widget=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7184,i,12959796091824069102,17737137371304205743,524288 --field-trial-handle=2140,i,10882995040004311842,14972751807780552433,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2144,i,12235289382348130861,484257520026944640,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=3628 /prefetch:14
        7⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x794040,0x79404c,0x794058
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3712

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe
  C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x294,0x298,0x29c,0x290,0x2a0,0x7ffdd50bf0d0,0x7ffdd50bf0e0,0x7ffdd50bf0f0
  2⤵
  - Executes dropped EXE
  PID:4172

C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC1
1⤵
PID:2388
- C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
  C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff6883948d0,0x7ff6883948dc,0x7ff6883948e8
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
  2⤵
  PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 6e391da62905ec2bc63d5bdce59b15ce929d5fdb44c6ffe6376cc548048a27ec
MD5 e9c02433417b6dd425e06b05eb368f69
SHA1 2a002e2000e39e5004cbc4e740bc5feef1c66d6a
SHA512 d02b9a9ac70471546b90d9a11ddc26d347a8dae8fa1f4b00079319970ca3cbfd9ef8b94cee85e395f2836b35c8b8dbcd93c9af34708bfe522b379e65a51adced
TLSH
T1DFF0DC1A61FE9862DF02C8EC75E08EBF7C26847540760865F01954F915686F8BA57436
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 8e73f38d1814025fd0851a3fa511c7f91329c33c561f7619429d117a78be1a68
MD5 311794005349c479e95eba3b51bab857
SHA1 e6591b40373fa3ab5f4f98bbb06ffb84202d26dd
SHA512 25ff38368c5dec1af074b0e97d8adc195ad9aa11dd9da5b5c2f787faefccaf6d47887c8b6af5c0f3c3a036eb73ae945870dc2a0ba2cdcd315467c1d6636db168
TLSH
T151C08C0833B9016AF1300D7F064253014BBAA1018D8283000F601228861CA4248A8C02
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 5ef814183404b0fa83a55643d8e56136838d6fd2c4c0a4fe2e3c782b590ba35e
MD5 edc2f91c9a1328302a3216ba14f85800
SHA1 ac983027d76ebb2f31b809be20cc417ff125ac4a
SHA512 d9602372646e464bc9637cde00babdb89eae67b7d82267c42cf9309c97136de45508a0da126b24b8f144ef5c01a01b4a52c0e603f846f07a20b39c8c760512e8
TLSH
T151C09B1473654715F10D117D79D51A0557B64105F5C7C3144B74113489186540871D09
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 f0df2e45649430f5cd88d17f61f47ef7b6399aacc1dc389a4dd1952a54e38f63
MD5 574dd99ed6d2e1ecf66c2c71de9fd12e
SHA1 c9658e7760f395d77138f8b8e1dee50e91ade2d7
SHA512 0cdb58808c7518768d5c81e7cc30855b43fb3aae885c86acf49f13b87e6fdecca4e095b9a2a3c147fd8492ea917c642b70204bc5273d1f0b2638a86c73383bea
TLSH
T1BFE0C03421F7002EF0F8D4745FD5BA371D5AF0260418A3B01FE05704B603900BF22A34
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot.baf

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\Cache\No_Vary_Search\snapshot.baf
Size 20B
SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
MD5 7177cd1b3e21f48a23cb47dc11b36f7b
SHA1 9e1086a6c2296b41c004834f7521790bb2941d67
SHA512 e7e8b2204e455f6e7fa5a2239cbb4c0c506562d30184fb07d63f8544cd0249226bd3d7d399ef0b69774e72afe100f9858da527b0e15a7bd3c35782d7513eff23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\f_000001
Size 38KB
SHA256 bd3924a0e10765c5f2e13315a90f6c54489baecc124ce633e2197d5105a68ca9
MD5 4e42af52d0c5f47d9139d7bc0cbd70c1
SHA1 50b45cafce78efb89afaf4c3cc69b15f471870ce
SHA512 414be3c60b9a5f2f5771c2c6318c70bd25e199d3ee98b572b44344284ab343ffa12accd1d4bbaa4383f7f5f20830163ec8d767725e73e773ce1906402cf1a065
SSDEEP 768:BxoF+GzsAl9T8kMiRl2gLqqVrX/QWNrIh5B8m+ImIhTrTeKZAr:AFtV1BMiCgLDX/QWNrIh8m+7wWr
TLSH
T1A2030166AB07F9D53A553A514042CE92B774A9032FAEC7F006739F2494FECAA8448DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\f_000002
Size 150KB
SHA256 7e9a9539921072c43596c9686078f0a7557669f11891d34dab3be25f5a7a4665
MD5 49ce7f682cf919ec501b05f9c84c7244
SHA1 bf8e2603769969d69963d3e63106bf247fb639fc
SHA512 64fa47172b6f88cec3bbdf2c201ad43786ee81efb234a24142b596a932616c48c518e0d3a2193f54b33781cf1d87afbc3b3f15a42692e21ba3c68b482163e64a
SSDEEP 3072:SPTi3It6CwsoAlrNyiISu/lBV+MKmcJdztskFV+G5v4d5jNiikkRpu:SPfdzZrgiISS+MK3JdzusoRifZ
TLSH
T10BE312C10950945FE0B88F348ABD641300E65FDB57B8EC3D7E72E893CEA195E24ED698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

134.0.5954.46.manifest

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\134.0.5954.46.manifest
Size 225B
SHA256 c864d0cb3827d9690c32a79d4226ecd0bf8ca7a1df1d9bffb38e00669f189aa8
MD5 565c55f49068193306d487c94d3b77d6
SHA1 b1c5ad9e62928b8690e376c923a9689e7536ac5a
SHA512 b797149e7dd707f82abdaf56e629316208e5fa85355c13a365d70cec581c5e45e91bb2953c2d55a106686f8d72c0ad2235611cc8268e5de4d4184e4404b98d14
TLSH
T1BAD0A901888A22096B2341A03CAAA0014118C767048CA04870FCB867BFB39A8A2928F2
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-100.png
Size 1KB
SHA256 56bcd46dcfae3147a8b8b3d00ee5041dad4655e83a7e829bf637377c96538643
MD5 f4d70bc86e8544d7758742c2eba89d47
SHA1 5df4635794ab25e2f88bcf8ec39c19a09383a029
SHA512 d20cbd543bf97890d64c07f9e99188604f4dc5def904ad74229a3b1d9d9a06fff93af711c99a178799e9de472d930aa52a0c154f0d2953abe5ffc3cfd1708ab9
TLSH
T11811C840D668A4ECCCCD5DBAB2BC3893D7529C198049B1DB4CE1E8E38C303050976E0E
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-100_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-100_contrast-white.png
Size 1KB
SHA256 3829dbefe8bd528be268f3181a902e1fe78883eb8f8aac679c9985c2ad13c6b9
MD5 7f69f89f11fd675b36e8de01de3c29ad
SHA1 b91e00e68889367de138ffa5e7fb3c9de2a18467
SHA512 06c162296c5ac62429e6e5dec07b836e6053cb4eb0291d8ed904f71cc42352c134870ed964517d2600f03fd7cf3821ee877ea83a330c9597fd7d629f9c2a6432
TLSH
T1081184F6422D2D1DF58532B16EE55FE299A82B2535D0BA425008C1194E2B512C900180
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-140.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-140.png
Size 1KB
SHA256 2637072751e1e6398c45d2c5b22c54adadfbbd4d3007238799f5da63f846167b
MD5 a0076d9b3db9054267a7c86c9323aea1
SHA1 22b85aeec3e3804fe1f6e91d5a9ac1c6a0153b6c
SHA512 8fb750bddea61501f8ce2b0d0c27d29f322c9f297777f26b1401696c836c844369a9f6890bbb9827682deb70004cd98a973a0742d2d218f12a9fc3c301f10985
TLSH
T10121F84FCC2CE4E4CEDD49323C15A326A33021C950036F8A99CAD3F2876474C68B71D8
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-140_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-140_contrast-white.png
Size 1KB
SHA256 ce3559b2efd6d547fb822440690cfbf793eb70c98154ad4dbf3a7c0e1af5e166
MD5 f601df01a867a51514ea89ac9bfe9b86
SHA1 827cf9859b7b1864236cd1f03e8aa40758285e82
SHA512 2714e67298058e8fdad4459cfa17e2c7c67353bbfd9ea850bb403e669ae085ba579c31f7d64889470a97565719342e6a30efe2f66566783197194433aa947600
TLSH
T1DE21B45BA702048EC2065E3F4D54C81B6591FFAAA3B3DD4B265303B0A44217E18E76B4
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-180.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-180.png
Size 1KB
SHA256 7ca510381079a4b166e9d5fcf0dc005d9606197e8636621b655d6459941139a0
MD5 0a76f51f6169a31402ff7c61cfd05161
SHA1 843a32d6dc0d5b9d97c5f475f96e49852823a103
SHA512 7056949d7aa9cc4c96f9c13d656cfffa9f9a49ca78f6be3037cd38cc1d8712917cc235099f24723bba26fc9ffdba015480309d0418961c1116dbe7b65de6301f
TLSH
T14A31D8C629E310F9F9FC01F501126A6CD7C095D41162215B68CADDB42CB37257BB90A5
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-180_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-180_contrast-white.png
Size 1KB
SHA256 f7eb888cd9bce4641fcb01088b05be242f616dc06c3f823e51fb63b53b6f14f5
MD5 67a0163cd9753e42360222a17173f593
SHA1 e4ee5c2288cbd5d354aad1905b917285a3daeb92
SHA512 87e69e15ba6dee402dbe5a90da864136ec2c6884c204a567ad461e0181e70514f73a7df22a47de63d4829fa937e56fc4c08cb6c5268313f7b9af1e7217d81f47
TLSH
T10F313C6F5D568577E37C42BCBA7085F5D325B31C400727106F34B2983814E5521A89CD
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-80.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-80.png
Size 827B
SHA256 f287370ff8c7e2ba120407cafe09c1fce674ae8af5bd5fcc0c2dd1c6628b9ce9
MD5 95a8f1834d8da00ad94c0cf2aa09853c
SHA1 7e830e3ef55b4d7b9a18ec8c151bebb2c28f0069
SHA512 c89be6e503c26efd4eec12c77e091570e187ff64928cab01f6f873d9ca3769f019a1724f76b57c9d4038495e29cc4106f919082913323af1ece7aff820c828f1
TLSH
T16C0120FB28489DD0CEE79271529CC55D9BC259065A80D0F7D2E9D8C05D33B49E678810
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-80_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\150x150Logo.scale-80_contrast-white.png
Size 799B
SHA256 0a9129bde051c17e96e516d5bc509e1a06a1e066a5e2796627cbef8630002b47
MD5 3015766c5ca769e54009f167550f7389
SHA1 0eff02455a1e0fa1724bb1d4333c3d24329f9e9a
SHA512 7ea7495163e0246f78f88dfd0ee72b8584108c286227d70cec9de125747f21f2618f46f7197f7cb9c0f40d297bcc3582cf70f54ebf7f9eb10941fbaa6bf0149b
TLSH
T17B010AC8D032EEA5D91788F36CA24FD59CEF42F000181B2C84A880913C030D6B03ECA5
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-100.png
Size 781B
SHA256 fb5662c5fde7d49862da2e0253ae03dc7e5f9afd2edc65d4efa6dc3a3026156f
MD5 ef710f4543a25076078fbc1c09ec9e2c
SHA1 e4ea1c2cb24cfff03569dab28877d11f9c6cfc74
SHA512 fc979d06806a69da71336533d96b1cb66b227064a224e23c6f5bf9d1fe4e85a9d9546643ce296ba5f04c025284d5ca2c445c52695aae669735a2a5b48ce07a00
TLSH
T122016002E621E8FADFDE023E322C446D4725035AA706BA1F00C6F8A72EF0B4820B7049
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-100_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-100_contrast-white.png
Size 752B
SHA256 3fa9dfc982544f3ffda0795beec69c65d6c5883be0de37133466e643b5f3aeea
MD5 ae8eecb8db4d20efbd816b887ef75840
SHA1 1d0cc741d0a75e5e8ab51dd8b6a99f5e679ef5db
SHA512 0cb71eb86ab2c5d4c70f04d7b10736aa453d51b56723ed7c9dc332f92ea428eb7861f23da2e30416bea8cc59877ba2c87f3032ea473028a7df8c6a299d517572
TLSH
T13501B5E19CA5D03C9D59ACB03820317AFFBF65062CA02F825474762B2010CB538E50CF
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-140.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-140.png
Size 991B
SHA256 84f8ebb629791e0b73cd53d7f3445d685145d0787a207e25842b237c98a8c99a
MD5 9590b4bd9378a2d8706dcbdc630fae8a
SHA1 751eb2aa5ce4e83133a73fdb9efffc013bf37ec8
SHA512 b2666efa916584c9b090e305eda116f2a90c58862fa36a0963176b09b493a4ce5e601a178c74be0f2e59811ad42cd1d5747e8a45ea07c3f5d52b28e177fa5603
TLSH
T13C118820BE023DEDEAD89D14E139505E86042902332860CBA0E5D4908EBE79044F095D
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-140_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-140_contrast-white.png
Size 865B
SHA256 99cd2b5809ab9c604613b305bc80e6f68b858c1289c07e84aadabc4c3768ff32
MD5 9b103e9dfc26dd4d837df8ab55ec4fb8
SHA1 6f46830a3a63e0eec923bccfad57d8391ac3e559
SHA512 e8023067638a9fb849ac9364a45c8be9a6dd325fbc704d960cf270ce1075ac6c9d57b7f96cae62985e92e5543dc2f2a43d473a2dcb0060af067cd474aab7e59a
TLSH
T103118AFB1644C6ED594F572F50DA9C51734B8A3B836E80189A3C869CD190F44CB77ED1
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-180.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-180.png
Size 1KB
SHA256 c5d33ee3b5e8dcb9e9aeae5f14d0e92cf9bdc16d6245ce65dd4340c8a0be4f26
MD5 7ab03a8ba1c0243b96c4124cd5341073
SHA1 7de490dd37ebed58337fc0db654f12398e84a78a
SHA512 c96846f008e8ab440009bf2442a2cb9db3d24452619c8c2b669395f971f9a316ec62693bb586a94e565f1cab893bf665112c34cc1fa46319e571e3fb4d2fc41d
TLSH
T18021E7612B26DDFBD7C182F1913B4A395E1CD582327461369CC2E1623C3772E1271248
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-180_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-180_contrast-white.png
Size 1KB
SHA256 e5112331e0e2684ffb5adc0ac23324d9836cf067111f1f5834c77b1153a8a5d7
MD5 1521be4b8c8f2e0ce20a89f163de3909
SHA1 c291448b74fc3d7060c1df4b35026084981ee441
SHA512 6a0781d275dbf8fad4ee464e759de74399918abdc99cef3c74e5d66a0d555a8bed363da964c15e2ad9ab3cde5a17d537bbcbadb10585aa1ef50f0b614fc39a50
TLSH
T1E011BB5771622D70C791577F5868F505DC72D33134A18DCB5CDF29ABD0C62B4449C242
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-80.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-80.png
Size 590B
SHA256 91ba72309e34c5336c09b8f5c787a6327082f275d5d7bfe491c5430e67c80752
MD5 1b4ff26a106929e3a5710900a9d984e7
SHA1 d3e1bb4fa64083743ab56ecd89d586df6b583bce
SHA512 d8537fa3b0da1b2ee7c8cfbe9101a7dca624af4532305e06f211e4dac799ae9b533f19d3cdf052352e2a926bfe32cc908cd3944b2543010e7baefe52697add92
TLSH
T11EF0E16019445CD54FED19969A3D4F30EE5034155813BCA70DC2D8369E2634598B260D
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-80_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\Assets\70x70Logo.scale-80_contrast-white.png
Size 519B
SHA256 37b0f1fb4a08af8a42e6d8fce4c7380ddae0272150d7a9bb8b1d138066a9ffbe
MD5 169dc90309162bbabf07ac3d954a076f
SHA1 a4c87f029a4f34d66847271cdf8c5e73b1e48a90
SHA512 b7633c8faa5614efb402c47957577dbacca1a1b3fd0bb39cf79eb3a06ec6a55f9b8c5ee9569271efbfd7d43ad348d275c0c6c9faf840663268bca2fbc6c64bb7
TLSH
T1D9F075C360D1ED222EBA2004E411ECFC747A11985B439885003B48BF7F77F20A90B088
MD5 SHA1 SHA512 TLSH

Submit Download

assistant_package

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\assistant_package
Size 3.6MB
SHA256 bcf1751bd4a26fbf8a66570da26e75993470b69e737950fc294cdb48d5269742
MD5 dce412b92d695557acda2870a79c1d29
SHA1 8a0c4b8ed4c292526c44d8ae69202217e2f4f5b2
SHA512 effa04d0d3fbdc24fb8ee4c8fa920e7d0f7d11aee4069703a48c47cb24dc3d17ccffda26f252d0f220efdb1c43cc43981265d90e61dc2aedea9334fb448ea4b8
SSDEEP 98304:DkiokFwKFIgGvsxiGNBJCM5AGvMnjU5+jBqtfAPylt:Dh+AbViGNByUc1q4Pylt
TLSH
T1350633217AA488B0E75249330EC1F2F96FBEF2710972969F3398076E9E61581D319377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\d3dcompiler_47.dll
Size 4.5MB
SHA256 dad8b0a7e85794de57e0adf71176ac9d0dcc7dd50082ee3a22b8c0608bc16c9b
MD5 bc3ab796d20f09f5e4f623ebd56ab89c
SHA1 261f965110610871b8401ee7bac874cbbbf723d2
SHA512 ab3524f04acbea21d30dcf04a43fc51adc471000a38b68dd3043b9a6aaef6001b0a4c41fd24250eaffce037670f69f2ecb2b317ec2f4b0417833735cee9b1129
SSDEEP 49152:K6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/M:KUdeqt737jFm5wk
TLSH
T13D268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\dxcompiler.dll
Size 24.5MB
SHA256 551848db9629fe944783c63af7209bdf09d644522955b38b61a84093f30bd606
MD5 184897511fcf4b44f544d945e308755e
SHA1 e721b4b8d3703bbf98868df802acf42aa3536b5a
SHA512 e6a1595e0fd3878d3b31d5d7c60ae276332adf39e4d59267516ba279d55ebadca19f4e3847219b174babbc0007b626233dfff8b260dfe62f616d8615d8b4a017
SSDEEP 393216:MdbPkEcf5nGTN4g2qxaQbiOT3tXwUn8s0a:qkfibH3Nnvf
TLSH
T1894729122646D49DC059C879C7678B268A6C30E73FA7B9EFC0F461252B79DBC1B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\dxil.dll
Size 1.5MB
SHA256 7def2d17f6777236179e1e855a06a1e19e46193ce8de1d9f6bc3c40c183880b0
MD5 02748064c8868034ba6070819b8825db
SHA1 1cb2e4ee960ab1d2483dd7b0eba364720b1ed43f
SHA512 2e0cc0642319b8bf7797403189c98f28bdf4c02f6ec7b72208427285f7e318c3bd3856c68f43e53c902d5fcbb4adbbf1e6ae418920a07f71920a64ea9caa03a7
SSDEEP 24576:WcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/1:WsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bU
TLSH
T10B657D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\files_list
Size 6KB
SHA256 a6a92b393512c688e29ee306223c4e22d6446cb49d882cfd3812fa7af34d4510
MD5 c3bd13cc30484f8117d6411787689f78
SHA1 4f94adec66a33c5e96ed3b7d48fc9c527fe822ca
SHA512 aba8acd32d00eb56e53dc957ea7788f516f219c75fdae286c4978fffeb9b97d9b0ae00b3d76e7c1739ab30e1ea7a1027418924359fdb51519e03fb1870828a1c
SSDEEP 96:TMyTfz5XZyITJhGwbx7Vt/JnZ7vMbngEDi1JZJiRORnOU:4afz5XMRwbxHBZ7unmvgORnOU
TLSH
T1C0D10697895F0265CAFD93F1EE61E89091342495EEB83058F7C70A5694A33FE02C9ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

headless_command_resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\headless_command_resources.pak
Size 2KB
SHA256 8c0af48079123a1ed6f03f0d830527b21cd224c2fc7575ec485c486da41b16c9
MD5 9c33095519168e92728c86a591a17862
SHA1 beec5c5d149d46234897395f72f95788a568537c
SHA512 f4323121659cdbbd1ac0872cde925dc6143ec2a3221c8ccbb2273e0916f1341beede54121e077b363e2995a656d46192758b65880b8dbf92cbac381a4431cde8
TLSH
T146511893360AB6A6C079C72C91DA9A7C6BE58325748DB5744EB70C33E9384A345C2871
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\icudtl.dat
Size 10.4MB
SHA256 d0a05dcc74a5b6ce1657a2ae44a58c0df03a1a07c24a4df2e3381353911382fc
MD5 f50c621247b8ddd574dc9790830f28c4
SHA1 ea84f3a773b5b90851753353826fcdf94576b3c1
SHA512 030df4e2c8f0354a97ac6a21774d6bab1246237bb71cc286b1a310b1a7602dc31fa056b8beb1157ac71b13d3744cba0fa71ac807e5f69fcafebb3cd827b553df
SSDEEP 98304:nHcBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndL+j89o:nHcBhORok2HiXUxO/RJk3IWhlYntjd/o
TLSH
T1F8B62803A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe
Size 8.3MB
SHA256 ed8a17da5e7ce86d6be3cb9956641c72033cd9de51bfb0a4b2caac6b93f2215c
MD5 9cb7a6660482c83b3f1308cc6716c71f
SHA1 5f0c0a44a8ea83efa5e18196f8376c2c0600b42a
SHA512 30e6bcb36c593e49774d9deb12a87d0942225cbcc785d348c8762cc6f50d1185b5348823a45ce268bbd03abaef321165b956788a5fb8e1c4c96c70b649437845
SSDEEP 98304:uh6i+ubH0SElWmLmgm3yrglOgw+Mne2ZQYNY8AFC:Li+ubH0SElWEZmXFC
TLSH
T1E3967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_helper_64.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer_helper_64.exe
Size 594KB
SHA256 8cfcf9d692045acbe3878d004f0f11b33bb371feacad18dc10d90ed4b54ffd63
MD5 6b24294bc6c8c6fd96eb5dc65d18093f
SHA1 b72a566c418dc2eeb62d0e68f0bbaf0c361feddb
SHA512 e8b85a123fc3f02e53fbfd424e0a2a7a7feb18f7f85f2fd13810f67fccbb11df7660ece960829dbe860c608fe1cccf8921535775032e1df853170a4e45781e9b
SSDEEP 6144:CLU8SW+J+Tb5GNgbKFaeiRwozC63/c27haumrv/OnlD/WYgo5J5PzOi:W91GNGKFHot3laumrv/OnNWYB1LOi
TLSH
T1B1D48E55B2E547ECD07AC1348A428556EA717C960F25BAEF02A0727A2F779E41F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\libEGL.dll
Size 492KB
SHA256 d7715f3af7236807406ef95c2431971183d581c6269793cd9d84395562d82eb0
MD5 3a64b23e690d1c3b9875263566e934a5
SHA1 3a3898c079761ead338ce861050713f8f0133f73
SHA512 8d80742d5df2be677df02eabe688768f3ef14307e822a45f73aeaabaee8e6c2ef55f5bf1632f42c15677cc9131810551ae008b4e5ed34d731338e5895ff6aac8
SSDEEP 6144:93cJ9zIbe8djApigXQoRHbhiqW1WlPmcIhNME0Bw2MoVxALd7mtVk:lulaj+XQgbW1WlPmcGB0B5MoVaL1sS
TLSH
T1C2B47C15B2D949ACD07BC138CA538547EB7178560B61F6EF02A0E2792F7BBE05A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\libGLESv2.dll
Size 7.5MB
SHA256 1967c38e67ed3e188a36cd5c749e11b84a393125112e03511c2f868d73cf3376
MD5 7431a4154741f35bfd8a09c77469e698
SHA1 48ca1798f9c018b51ec1772b6ab521000505e052
SHA512 f1bf0d03374b541f1bbd723a2c3712aef305f9643c913fae51ce5fb74d59661de14aa3a28fb94088686ac351d0e74688bd98c1a371d50081092cd22d9cabebba
SSDEEP 49152:4Tez29nJyISAnlt3ILAQO29R4ZF7fcu/vAlGyuP/K8IFElZlrWaQFItsaa+TKc3Q:Zm8LqCFMZ4PSWcn1Hs/MYDzqU
TLSH
T12E867C13F2A240DDC01DE2B49757A227F634B8450764B2CF2A9857163F7AFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\localization\bg.pak
Size 998KB
SHA256 c6d6c2f4182b99be8cfa1d53d4489b7153c1f08b5d99bb33ea4d626c741c6f93
MD5 4705b8df365284ecdc9b8d34037813fe
SHA1 8653ae627518e6f61e7f7a30e3cf57e87914626c
SHA512 fe3143d626ad10669497c259381a725bf448830125eea1e737f45126651f22264b1b68bd3937a57d20ee1e110273f5f0b1151841918283fc0390ccf4a124a2a5
SSDEEP 24576:KxBxeE4b3JwoGvqG4l9cI6dBBuK026g2HQ2WrZpvYAgCzQkEC3UnVb6fSIAFWVI9:KxgbIqRydBBuK0tQ2WrZpvYAmUUnVb68
TLSH
T1F32535A15B9A649F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B887BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\localization\bn.pak
Size 1.2MB
SHA256 7697616d6cc1a5c742b1a3de1f063594c3a4f1f6e3af3950bf903e7ceddeda4a
MD5 480b435312233e78ee321395a4233bfd
SHA1 3f481c8bc132ec193924971ff6fc744056086f88
SHA512 f38515dcb3b525030e05bb98b0cc2723e213be1742b99bffcc1e0b706ea93d49b177a1ced14a3d77ae8749975dd137c59d7b80342508919638db44e95e01dbf8
SSDEEP 3072:3H6YNFxz08tpmUnQ4Z8VgqZIHZFQwQskOTGQjwI1U63x+TUZOQUPD9:3H6Ynxz0WoUQ4Z8KqZwYwL5jw+x+1
TLSH
T1EE55FF209C6E81B2A8D5CDC9434C6330C123AE979B65F74DDC17A25938ADC3C8DADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\localization\ca.pak
Size 628KB
SHA256 23198bd37cc02530154bc83f42f6b025e27f377390c4065a9efd1c4f178fc16f
MD5 9056d1386e063d5149feaef9a1f6a9e9
SHA1 8e2f33accece81b9d4883b17230a2e5a70ee2270
SHA512 f4fbcbee43b74ea97005fb8c52da6b5de651eb0ebd488314a4c646bdad14409c26da362dfd35d3c88f5904daeba40b242efb9ea3484b941b7b087e1e5b542a2c
SSDEEP 12288:JFKUO7S6ybGbf1bCCrz+W58rP8lpfmbVi6Z6M6AqHl9kdkcBKMe3aR4Uz1oO5h51:JM5/vY9VyLgQ6iBZnt+ja2d
TLSH
T183D4F7238BC83B760493330AFB42C257F09CA9847B16D254F5EE1A5622CCBDCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\localization\cs.pak
Size 627KB
SHA256 0597f28c4cead0a6aa72e956f1561b0b72910f86990e3466b78e8e7c3652a3d7
MD5 632bcd0fb013120d84f4c5b32a8ed29e
SHA1 1fbe4fcceae5debb14f2c0dbcb8f6734dabf4eff
SHA512 ac8ed28acfa3e5c73aeb171ee2367b2295230ec9cb4708c9608cd91b68178a4bbade310b9f23047e1d331909282bfb23d431cfbca3175d5935b4b0016bf9f89d
SSDEEP 6144:EXDbFeFBgcihKMeozHJ62GOgISBaq8QtsVVpCvJfYu3qjWMqYhD+VV:EHwaxMezHJ62GOgISMgFV
TLSH
T1DFD46C1FEB936439584002443BBA5228BD5E83140B6EA9AB7CCF9C91227177ECFF1D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\localization\da.pak
Size 577KB
SHA256 1864accf007cf959ca4f015aa05ac3a561854cd7869599284e273b32e57135f3
MD5 e3d2b94b1957635a2f6ae0fddbe90940
SHA1 931c470d8f690c721eb384864018b9a5799618cc
SHA512 1b2fd59cd3cc6fee984da52509e4ac18b97c053358753732c5ace889b8d457f88a54bbabc465ac73efbd4c32765ab967c525e8f5cb64de6c4122ff34a263fb29
SSDEEP 6144:Or2hiDIXtUqCRLj4ms62+wBzVWJkTxLxVtsl0gmd4AdCfwgKszZh50RQgkSCEd9p:CNS2R7qak9NsrENRQgkmOZ7ZuRYNQ
TLSH
T1F2C45A4BCC9C333F89A90764F6118DABDBAD543CC684664F75D8903A16CBD6092BF2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs.json

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json
Size 1KB
SHA256 3f0a984182fa58971e103cf657bb5a2305ebacef63c07ae49580e2da7b3af017
MD5 98c9d15c64c0f3a2ed73722b77e2f885
SHA1 60539baf88c61a6213d015fb60dbc86416397320
SHA512 84d35f64f679c638cbbabfbdad5a825e3a7dc631632a39aca912b93c78560addb71d62f7d88fa4ab4a3be26b49602d54ac4b5759e9f55312c9a32f4a8f6d981b
TLSH
T10731F8B04405207B7F22835BC5C3BE86A1071903E02820E4A9E7490A28DFDD70B7BD17
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs.json

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json
Size 1KB
SHA256 35fc6d730bd18a143eef49d753482ba37c668821c91f44dc13bf0499e0ce3fb2
MD5 74a318bbe911d1710ece25448939f283
SHA1 0c214061b3e09cc36a0f2c03d7a55c47e8f21b62
SHA512 8c55a80ea0fe1dbeeb5ce89a8f8dd4688e6307ddfa3b6453683f2a51e5c7ba93627bff516d8600cf6d8aefd0ffde9fb7dd027466226f5946b11c45a3271ad459
TLSH
T1BD31D6B04405607B7F22D39BD5C3BE96A1071903E02820E4A9E7490E28DFDD70BABD1B
MD5 SHA1 SHA512 TLSH

Submit Download

Opera Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\Opera Browser.lnk
Size 1KB
SHA256 4be5c120c04103b4d0e1fee94f19df8611efef808fcb94f1d443ce60b6fa435e
MD5 5cad8449931cb2deeb0f2975c1feb737
SHA1 e86167d2262e73b8941bdd8e8283ac8b3c9f5ef4
SHA512 c35e5b315541c742656ee2b4410541411f718a002529e57a606400e0f97eb625a0f408f47d04aed8355209d3e38a5af6ecca380ef2c28ed848599ab2325234f3
TLSH
T1E82147053BE62716F3BF857404F73B698675B852AF4A8E0C001083991974181A84CF1F
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\installer_prefs_include.json
Size 222B
SHA256 96326abf9d65ccd2dbeac489cfc4ba26cf09c4bd54750f18e74d55aef56d3f15
MD5 77a75a90032e7722f1d445ccf7bc0d6b
SHA1 04066e54333278a662b0edfa0ed611d05b7d3611
SHA512 3820364d12c6003a2b4294e2b9530b7dc4cf705b91619b172c1a2fa99a4ba754590260aaed8fb7613b3702b8087c4a6f91fe21036ba5dbb593d1eb3e84d76ece
TLSH
T101D0A7D6802BC0E369700243783673CDC28B2B018C71A98AA3875161407C6A321E6D1E
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\installer_prefs_include.json
Size 237B
SHA256 0636dfd817002be24e804358784c771853f38785749e7d9914508c6f017740df
MD5 e6ec1246e82f118e652b14c3bfa21dcc
SHA1 48d2f8b04e34a32480c0156f84a5749309ef887f
SHA512 ee737e5594cc4c661e9f7fb66d03a268ef567cd8312a76310e821eb472709709610b617123c7d7e57ce5e304e961afb62874696745cc41a495f348eb50dde019
TLSH
T14BD0A7DA803BC0F36D700283783A73CDC28B2B018C71A9CAA3C76161407D6E321E6D1E
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\f5c81176-b4c1-4ab9-b3b2-c5da7d1b3145 Opera Installer Temp\opera_package_202608061543381\installer_prefs_include.json
Size 1KB
SHA256 8b5d9cba9918b49a2d39e28c693cb65aaf1168834ce436c377c743a52929cc46
MD5 c31329e489e520a6fb3ed2e26e4d82f0
SHA1 706bcaab40286c4001a5a0048b960a1c817a6275
SHA512 e3511fecaeef283871b4512f38cc2ad8e9f887accdf823fb35e2c81fe2de0f352be7e17d521230317eb2f81d703ec0886c2a8ac8bee5789eb1eb018f931193bd
TLSH
T1C021CAF45005F0E27B31C257D9577FC6D1471A03981435D761C2085944EFDA20EA5E3B
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS43010859\installer.exe
Size 8.3MB
SHA256 c2a6825b895b245bab9774e69a450a11a4352eafa8d4da5fdad0e81341d4e67e
MD5 9dbf6590b693218b7ef20ae8de7eef6f
SHA1 6d8a4f3e48bbeab782da7166a8700bc35ad39416
SHA512 ebe898c89ec43db14a2744078941647737350cc27bb515fa83713e372576c0ce77e5ede72b227d2dfc369bca1c6244b3ceca5ee443259023c05d636ba81f8147
SSDEEP 98304:2h6i+ubH0SElWmLmgm3yrglOgw+Mne2ZQYNY8AFH:Ti+ubH0SElWEZmXFH
TLSH
T1EF967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 fa8823ccc71662c1f6734f2608b15ec78a1a471e5c8563148353151b72282bff
MD5 e0356902ac8d1b7685a719b9c55cf8f8
SHA1 d5fd4c5a8ca21308a5f9bba2043468039912bceb
SHA512 2b42813ded4547fc8b6626b8f2e4143e342808863a11003f822c42ff89df818c4b80dd93898573a9b736e677ef4170f83d1b387e464c611d06ba57566f271264
SSDEEP 49152:XVAbwXR+eb2jcWlFwfYud53AgGKP9u1ce+UhAOlY+FGXVRrmUFLm:FAO6IWzwQuddo11ce+UnlpFG0
TLSH
T16FE523127A81C835C5B311334F89F659A17DF9621F32D6CB37981A6F8EB06C09929F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon_opera_one.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1056_2101629151\CRX_INSTALL\favicon_opera_one.png
Size 2KB
SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
MD5 cd78c5defe6084243478de9874682e1f
SHA1 708c8c0649039ce9b3f8894d00b712d65d488ca2
SHA512 96744c72f623462f1c64c2e49e7a2387846ed65a78d94841adb3bb5b52f27d28f657ca3f2910b6b1b338a032a9b0e0ac47d23e7b25295d6841480b32268f4db2
TLSH
T163414D878974A4D5FA41D0215A037D9EF9BACDEF40970E5010D9043A427AF5573AB33F
MD5 SHA1 SHA512 TLSH

Submit Download

Icon_Light_Neutral.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6252_1214898673\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
Size 2KB
SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
MD5 0566b67d5fa120d6da250a92577c8873
SHA1 0baf54c5f6a7b8cff4c82d22be9113c43a099c87
SHA512 9dcb904ef68419b2462d88133e87d6f4258d8f53f05ed12868718740d6e9467ab2d8769a79727c3dbd01c6807aa5e4863f1874465a7dc95088bd724f9d897fb5
TLSH
T1CE516D6D716E2332D0EFCE2E04C6860EF8680E9C50489454BAD506EF8905B9C9DB33C7
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6656_823988162\CRX_INSTALL\_locales\en\messages.json
Size 401B
SHA256 9ad8ffac49958d5bf771eb6f0bd7462b32597696c9d0a45ade771ef8c124b1bb
MD5 f58e359a5a09514e503a7de060e5719c
SHA1 469e51c68e204d8268eede68ef1cbfe1e6732f97
SHA512 5498cbb61a7953f5780fff2ebeec08e48daae206e5c237686b41f771370874bdfa52243db1050b67f052d7ea400e385f73cc4c41185194f006c73f2e6f174b7c
TLSH
T1C8E09208D940AE6B52F792123C787A15F72E476B0500541A7DBC500D0FB1AAAD662B58
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6656_823988162\CRX_INSTALL\_locales\en\messages.json
Size 387B
SHA256 554cbb0514a7897ebe50043e0de9fabfcf321dcbd3c39e77cb96e62d871c7bc3
MD5 1843060be3fce65295490b449d0866f3
SHA1 aafcbcfb0bb42b494528e41be2c2c1a0b988be9f
SHA512 ed8eec1c2d311979d3643e2110ab94e917706e8a6bb04afe81d04f3fdc2b666f5eca044f7d1fc15330f9bf0e7a56d05471746603b2cc40a9a007540d4afc2910
TLSH
T1DFE09204D940AE6B42F642123D787A15F72E476A050094597DBCD00D4FB1ABAD662B58
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6656_823988162\CRX_INSTALL\_locales\es\messages.json
Size 424B
SHA256 b04b308252b490b9555e5e002c5c6da63f3a6d517e2f659a626a500467e21100
MD5 a141894bffcb1c948e75fa3a4cd1c0b9
SHA1 ee4ddd5e77b511bbaa535d683f4129cdf542e941
SHA512 6dde8048629a446aa9bd24b4608bebfcaf1555cd38d2f264c61e7235141ffd871993279044cc7f88a3fbd608693f6af78ec10f4858def821a646350718548a6b
TLSH
T162E02B04D890FD3705FF52063898E616E3E047913814958D79AEE25D1FF2EA65467F08
MD5 SHA1 SHA512 TLSH

Submit Download

preview.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6656_823988162\CRX_INSTALL\wallpaper\preview.png
Size 464KB
SHA256 c5a2b18b255c6a4029de97ef9d00af6e563b562a2abdbee1e934ff77d5a92c29
MD5 b22722b42e8b196c0e26ab8a8c6508c8
SHA1 2c4de3caa4409a164e31837f6bbf54c99d922c85
SHA512 a0904204f795dc7cdc6612867a87f60cbd27d1edbc70007e1fe5c4dfe83165ca287aed3319409a0829815e5175480e085775a9a3285d1d20d629b28641fddc99
SSDEEP 12288:lrGu17lQ0NW4Lwq23Po85e16slc0hyKQuhZSAS2T9PPdHNCPsOP83JDxj54:lrxvw73H521IKxh9S2TVPdHNwYDxN4
TLSH
T1A4A423E043F7207FC6678D44F640C86E15ACF52ED99C58CBEBEB401541AB8A4ED1C6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 c8d7210ace962f1c986f14c9fe104c6520a357d0c9e63b9e4e92b8c49a46cc9b
MD5 b878e1a44476980646266557acd91e66
SHA1 55d96d57586153b190dceeae4dccda913cd43713
SHA512 f185aebfb26bec8d41fad051e6ae89c93269abc7da69e7f7bb8e65f0f1849d5dfc1b7c16a3bc8ced3345a1b41e1b2e1e8bb091a9ae68e23126dff822345ff775
MD5 SHA1 SHA512

Submit Download

1db180ff-f615-40cd-b3cc-cca0ecfd4889.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\1db180ff-f615-40cd-b3cc-cca0ecfd4889.tmp
Size 456B
SHA256 ed16076561fa94a7c283a0e9071b55edd643cb24728a54f4ef890250d71f08e6
MD5 7ecbf1f4992e2073393bbf20e350f7fa
SHA1 2d1f322f6d785bfb756e179ab3239265d003bb0b
SHA512 ab8623480830400239173e02cd202abdfff4f970f5f5cc0676a1023a65d846d8c69ca13b6ef70ab6c2802525b86c86d7eaa956150afcf05bc407cb9f42608128
TLSH
T194F0DC54FC158738AAA9BFF13BB93551C3994480ECD061E264EE104F021870D0F03270
MD5 SHA1 SHA512 TLSH

Submit Download

3d64cc90-b421-4555-a957-04d069dedbd7.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\3d64cc90-b421-4555-a957-04d069dedbd7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7e67d8ed-0c4d-4539-b398-d7cbc180ccb0.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\7e67d8ed-0c4d-4539-b398-d7cbc180ccb0.tmp
Size 90KB
SHA256 497a178d627d4b85f824a79af1f5a220f0e14b933620df2e0864b5188f8111ad
MD5 b8c31cd3bbe11b5e3a707451af4342e5
SHA1 d35d5de70efc4579dc0882da7f59f801d0aa8bca
SHA512 3a003e3cda98608b649323afa0097393f82886c9313931c3a3ebae7d79170c4b3a0666bfa96083022cca465f8223df55a67a3c238ccf429daa2734a0e4d60e86
SSDEEP 1536:5HaHl6YAHYXhH1wHjaW4Hiu/HfXHVISH9HwUHtkXCHMCkvocXTZH5HEsOfDUHJ9H:wXHF+A0yCWYATs8GZ4CL
TLSH
T1BE93D8EACCCD9E758FD9C7F8DC36A71B99940005AFDC9E14A7FA804C4386785213E686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ff892aa-c2ef-429c-ab39-3ff6fda84cfb.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\7ff892aa-c2ef-429c-ab39-3ff6fda84cfb.tmp
Size 171B
SHA256 492fc79608059835adef856688baf5c582a9ca812e864da1d2674bf99a00fbc7
MD5 27be1e602d61c59000f5959b538a16c8
SHA1 f91edada447b764f1b2eb7f04b4cc49a67c30dd0
SHA512 292acc51d7dca1dc18cda71b22e4da32d6b00780fc95bc7a0a8615b0d89f89369b6912e953a6fcd14c531676bdc1c6d268f48a380a16fcd47d99496a90e0eec6
TLSH
T16EC080697DD03A444E491D7EF02935A551571105174065443C9901CD13255BC595EA64
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Bookmarks
Size 33KB
SHA256 cc4b1f4e6d17845995f88f0db5a688f523383c504a4db4ab6ac5b818a4a9419f
MD5 e991477e89baf0ab6c306f72a96e03c7
SHA1 e6c534035daaba1f68af976dcb559e4479c99d73
SHA512 efe0a1ce705774d2e96d302f77f5172787ca3ba535d3b6058a6f32a9db95e69dbb2f51c1f0ca2e58ba892eb649501f12803f15bdc494464bf8a73cd60cc94b63
SSDEEP 384:SiJ1LaMTCvWG3NDbB8i8EjCRTyivVybTKSzA3g0P1tENQb0N32y2UuMjPZEZ1Dr0:Si7iXdCRTy3m3gmgG1c
TLSH
T1FFE2E77BD4026CBB41B552D564FA671BF686232F5E808D8B77BCD88D8F329233216709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarksExtras

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtras
Size 81KB
SHA256 e89fe32b7af3207280be11a3d95a5cc43b94e259d1f0dd6580368be7b6faaac4
MD5 a3900a977123e2ebe8d40aaf016772a9
SHA1 33052c637a9b748d932998d45a4066efad60252d
SHA512 4c79a53cc61117ae1c7243b3adff0956446b2bb46505773f53c54ead40014c78b904ed9b0a3b32197e64d61824696f0feed15495873213dd240620cdfbc2a8d6
SSDEEP 1536:wjI8EkhaJKXdp/B4+d/BuzT05ZaFbaxjWhMMbg+nNo3cklyP2C0:XkhaQb/B4+tBuzw5Zzjihnt0D
TLSH
T16583F1F042612D1F8B6C780E642D2F347C899F634DACB8A89E66B9C244DFF1D9D601A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 297d152695bdd5c6b98565c5a2ac1b12a61562b0e65e66e7fbb802ca2c135d9e
MD5 f0fb1e33939717c54f26821bba3952d9
SHA1 6fbc1d1329caacad83d88b867836d77c1c3699f8
SHA512 8a9b8e38546b7b9c605c31030eec2b60e5f94e3670a4f125ac5b66053e0f71427945e81ac91791b01eaa3359f6d2ab538b77dbc56c68897420b0d0bd2d60c8d3
TLSH
T179D012B840E81411FF17C7386522CD77D3243935C000370BE4B651A45ACF1C95457754
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d4507a8455e77ebbb829276a5cd6c1e8dfa69831659aa06310febe5999c62e43
MD5 bdd95c1c6be321dd245171a269304ed0
SHA1 ca784f7bae2f4ce43b883d56d8de660402264bb4
SHA512 a55258b79f8d24b7edb868a39d093917a7cd699c4aa43dfd01608da96e17ed81024b3ca5954b4ef787be4a7f52da73df13a94e2bc22abd2a82ca799e6e45f56c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 02e71ef90ddabe4a173c0baa88975fed19280ae07f972ebf3a093629df3f81b1
MD5 bf954ed58884184d97f1e92895f08ad2
SHA1 c4b411d4a8940540f149c61c0fae8e8f4d5c7f4e
SHA512 69c56982c4107ff69f9e6c0c7e3269b26e86bc70ad2fc65b3acd3a73a9437e8cf295c59cc7388343dc45bfc99921febddf3f6cf06a76fc031175f1eaf665809a
TLSH
T1FED022B820281402FB33CB3851238173D3383C32C000360DF1B6B0642EC81ECE8A3B68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 bd5a2eaa682c99bacc4dd2c2832b1c68e3b7360772da716e5eace61773061b0e
MD5 5e6b5ba363722203df6f7bbceda06417
SHA1 1c42ca2fb30de8b9bb4df496c3e86b9f67e039cb
SHA512 9e3cfc9b87992055380919a64488a35e8dae23ac0d01566929177956ecf630667c92dd21f3b8b8a6222c44cce7873b8cacc0e82b8070365c24fb760100b4053b
TLSH
T1CB0122A658A04672FF6B86B401A75DA2F635AB35D505370F96307170AC8E2E8A01F365
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

main.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.7_0\main.js
Size 46KB
SHA256 e1b3123f37dfe988a8a22427e98d06cdf472c23429f6277f68c6eeb1626cd54e
MD5 3a4b577e6f2150e055d503fc17aec243
SHA1 6ab613cb92850a343caf28887301748c73b34722
SHA512 d4fb08f3423ddb5501e2d50c4b3c6cec5be34c9b149d469074119b144fa54a317199f485a8dc7eb650fa7762a0be79b49a2d99b4cbe9dd8408a632baf0cb2537
SSDEEP 768:DvKIO8ifSEWA5W847cy/FWpoMz908/lK85aipQqkUlVZm5Kdnr4WavCiwdC51SqJ:un8VEbWXxYNG8/A85DQqkslr4JPmCHLn
TLSH
T1F22328996269687E0BC2D2ED925D1313952460F8680D84AC723CDFDE6A0FDC2127CFF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_128.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_128.png
Size 7KB
SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
MD5 8723b83f007f8c910ae071e275f99383
SHA1 9f76b6719f4dc7ce2ae4ce96a8577481735f1ecc
SHA512 62256dd55be00b1a70e9afc127ba2079fbd563274c6829739f99fd02c6bcd2b2afa21337d8f58a7d64a716f41c0d739ab7b8f78058255bc1b59450eb0d0bdf4d
SSDEEP 192:mbNUdF2i9HsyhJ589/J6sdWQG1i+5pqG/LzPYehuNBpDxw:TfLeyh09/J6sdWL1AUvfhOm
TLSH
T1B8F19E690531CCD4B5B99F755309C0DE2136CA98A431AAAEE0CCF1CC3C573697ACCAE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_16.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_16.png
Size 653B
SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
MD5 e4fe7d0c1c77bb00d492bf59196fe3d3
SHA1 350335cd55b2acb2b8957cb79257375513b525f1
SHA512 73b6ed04cc5b46d700bf34bce51f50b19c89e9310053a473f577516a270b4ff7ff1ce954c18430c2625439bffed6153997a08d1aa6d3a4196b4ae5ad4089d556
TLSH
T135F0839A772C8958E9DC5C30B21F4297EA8C22E8C8431601A33F52313E63812138F08B
MD5 SHA1 SHA512 TLSH

Submit Download

logo_32.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_32.png
Size 1KB
SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
MD5 3e4cddaa76d8fcd9ac7b64fef89d4b74
SHA1 3a44b23b9b8f950f9168361da56cf8f86958a408
SHA512 9a6317ed1b9e919b3a6e3fd260f88b297b82498d294d7c86d1a40c20c35003694865f06632d1bf281417418b48122b4e01296e17318f7fe77612b3a716417bb0
TLSH
T1F221D8DF8464ED2E8531C8B3C14354E5E2BE94B3E47B9479F06BD8510C307958783E50
MD5 SHA1 SHA512 TLSH

Submit Download

logo_48.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_48.png
Size 2KB
SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
MD5 1a3f93acc11338a092785da97956c034
SHA1 ed1786563e53ad2fc076edabd25accb4ef241540
SHA512 7ff3c3eb9b7e55e799bc8c8ca66225fff47c52d85e1326f99b2e7c1747624462231e8dc9c09cc4d6e675d072d8da41ea998f16a4576de76c6575cda271255e85
TLSH
T143414AB201335E202C334219CA7203E2A80CADB0C02A7E91E0CCDBBACB00DE5E2DF506
MD5 SHA1 SHA512 TLSH

Submit Download

logo_64.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_64.png
Size 2KB
SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
MD5 9c3af737a428dd3daa949313d69be52f
SHA1 c24aa988066fbbc4da252b858fa738e20cc42c07
SHA512 ed9f869b3912eb8bf27624185c3ce648b5a586576deb7b1f9a0b6770fde1109a81fdb771a76f0902913c55aef7b6020f386dbd92a06c7ae106ca5fd593295c0d
TLSH
T129515D9D4EA1ECB15A2B46339AF935EBC5F0B37A0B2C277D60C94437A9C255231214E2
MD5 SHA1 SHA512 TLSH

Submit Download

service-worker-loader.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\service-worker-loader.js
Size 49B
SHA256 f8eef7c260d4743817755ab4987619c18d1266f27d2435f32ad3f50494a9058e
MD5 98ba3e7390f54d7b7c944a81543425d9
SHA1 017515b72aca14c87c6731b50ccf2ae8c1c25566
SHA512 7569a6aa2521d00b34f4e929b3a1d8fd72f5c4f10e63524deb90414be85ced641fa55299192e6c3646de1a41649b378de00ec1fb54a222e708de8236d63a490c
MD5 SHA1 SHA512

Submit Download

favicon_opera_one.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.57_0\favicon_opera_one.png
Size 2KB
SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
MD5 723cf51fae375f557b2f891a2ea603ef
SHA1 40f374149ae6f8f5b847be59ba019744c232ebd5
SHA512 d0f64a88cf62642adf30af333f81481f43fd2141c63a135162152d1c7fa705b52121cac69edab0f93d35cc425b43fb6d6af2adc4323e5ad8e11109a423ff6eaa
TLSH
T1D4411A8324F7F9A0FE30E5AF1353E0454E655B9E2B512738128D08B4A4BA6DE92D202F
MD5 SHA1 SHA512 TLSH

Submit Download

reader_mode.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.57_0\reader_mode.js
Size 112KB
SHA256 4f72bc46754ceed048dccf5c83fa36067f144e5ba13b046b12538808986e3252
MD5 59de0decd0e4751b14231dde34507403
SHA1 5892abedcec573765d8247204ae038ff4c44848c
SHA512 16a7716b4afd10d0984c99fdb4e2617af3ca0a96f7599d22675924760b72ac00bd5460de75b46fb26bbdeef9ac4ddd432bd70c47467d3cacf345af5e552de4db
SSDEEP 1536:Ska6rka6dmEctzRw8qxUyIVGjYG6xpvAI3z6A0k5miSZ75U66dpXdd0yUY70Lcx6:Ska6rka6vszmxnS9lbv93NddM3prX+wH
TLSH
T1C4B3D9ADB3927199928320E502FB0047E3355D451C1A5038F669E5DFBC24AAA62FFF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spotify_frame_interceptor.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.57_0\spotify_frame_interceptor.js
Size 5KB
SHA256 a6b9c0dcf141b8ac58176b870851294e492ecc79a83c8efbfc85e35cb3cada0a
MD5 6586f73b98953dc3d70ffd9a61e24911
SHA1 3e9de04cd595f3a391392a92010633d1d0608a38
SHA512 8ff2b9b2ac25b0cc60e79ac6399bed6d02a29b1f92ab499a89878c63618460a70a2d0e3f2309b227fda01e03c3427c4a11940b4b95704ada5689f80c385adda2
SSDEEP 96:xSVa6rQaSVa6j38bo5bYe3m/I6FScpoV9FzKovz1fFUAJxuisb71TTta12Ho6Io:xka6rka6j3805se3m4XFzVJFs31wx6z
TLSH
T16AB1B505815C4C7D8FB5028A9ABE135212DE2283787BD4C4EFA3C47597353CE9213BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\background.js
Size 86KB
SHA256 bc24cb72eda19eaf9ee195f014bd6247e826cc594e73461b826c6bd0d5f50dce
MD5 c8b19bb6ffa9ba9d07b010ee2483d6fe
SHA1 db1af85512d439f749c1fd64fa8f7dfbbe5f682e
SHA512 841d08ad1dfd23a85b3749dcec341c665457e0648509821ac140fe0ed753e8b0ea4a24e7b6ea5f06958f4ddb0b65f7e58250b783eea11c321fb975fbea63db46
SSDEEP 1536:PYHgfauhQ7F7yEPlL65+aSWr0WUvpyiSBwhmSvGj1S+f8+:PYAiuhQOokiSBwhmSvGZS+f8+
TLSH
T1969308CDB6C7F26293E390AAC03F101FF23A6D19740D4454B626DDD1782658EA236F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon_Light_Neutral.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Light_Neutral.png
Size 2KB
SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
MD5 bf24b39c7ecacb4ce180d5013d771066
SHA1 8b05f38ef028f9a6ca5411dcbc347d6672c252a7
SHA512 2398ba9b4216289bb2de142d614f312585f1e14e759d211ca169e1e54248761a78585f8ffd0de5f9112ebb349140f0346994b8a52a290ae22768a80d19cd8a9b
TLSH
T158515DCD26176426C397F654D206052A4F0841A72EDBF6E949306CEF9C53E0FD6DD760
MD5 SHA1 SHA512 TLSH

Submit Download

popup.js.LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\popup.js.LICENSE.txt
Size 1KB
SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
MD5 56868fb04ec3f6436a450b0be0c49947
SHA1 3114eed847366239e1b72b45af410bfba81bde4b
SHA512 a2211ab99b6d04b7f0a7c5dddeb8156c7c24e8ff0b2860cbddb6273d25089c7e066ea6be363a610553ee2b275ba4f7750f9456b30251000596544330d8262dc7
TLSH
T1CA215B5A35F53633026149A2670793CEAB0C11EEA4BF347BC4918374AC344FE8394DB4
MD5 SHA1 SHA512 TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\rules.json
Size 839B
SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
MD5 112b4a4c6143b507605be0de6f359ff2
SHA1 4ad368eac9b4965eb0389d2da4b2723016c8c69b
SHA512 9afaf96cfcde9688664d33f37168b9c637e414c3fb768b0c70cdb19cefcb42089e8f464a8d32bcc21a140414c0557fbc02c12a29a5eb662405d55ef7f1781b2f
TLSH
T19301B567C4255C230342217CE42B0719F970E14B6E646E2F3F9D845EAF5E47EAA7238E
MD5 SHA1 SHA512 TLSH

Submit Download

2564c8f3-dff7-41f7-8fee-19bba48f982a.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\2564c8f3-dff7-41f7-8fee-19bba48f982a.tmp
Size 27KB
SHA256 3a9c655a88437e331f50a23bb40cb1a3de86277cb1a9488c81c426598cfab0a3
MD5 0ce5874c8dd17ed15835bd7995b1dedb
SHA1 5598cb802a08f2c2db0e8336cc2662f81227a3f6
SHA512 a5d97c7608d92285288b3da804b73f1ccf5987a46aa635a9321fd5b6cebdf4f80e302310c5524e63301fc4c7b222c98dc5ccf8094dea369ed3408657079c6495
SSDEEP 384:Oi11a11N+CLD9mj7F/dMN0ADl+bRqg+T3jbp+wHL:P11a113D9G7LMN0lb4rPbp+wr
TLSH
T144C288E1E8589F24D65C3836C2BB9C4986ACBD3D1929410FB663BD00B9EFA0CD5C2F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76d1c775-ccb9-43dd-9782-2cb2f3ece42e.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\76d1c775-ccb9-43dd-9782-2cb2f3ece42e.tmp
Size 27KB
SHA256 2c588a8ff5bfc6c3f538a81c8b530c91c22219037817dc93c394c5b38f476ba7
MD5 0248c08c93f9b3571753eda809bcb153
SHA1 29ec2e25bb445c3d031e270c410587a8590ef5ff
SHA512 43bd74a93aa82473942e9fef82092391d3638c9419e619b7ece1699a47ccc34d3a2549732a6c6e16b8b196334148e432b898be3f1c0bafc34f6b00b6b1bce66f
SSDEEP 768:rHG4A98DmaikqW/baphdFmVoLFN+kKGXCcZ:C4AyDmaapVmVoLFN+bG
TLSH
T18EC21C1109E5477CEBF7B1704E8C8E2152ED68273B31BB25CF35DCBA2934EA521568B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7d69c2e-fe3b-44eb-b384-60a4e4e41209.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\a7d69c2e-fe3b-44eb-b384-60a4e4e41209.tmp
Size 27KB
SHA256 24d702b78ffc27336efa3e51659931773755a9b1e29d011f61412ba6587056a7
MD5 0031be0a110127cd3e80df83115b8a78
SHA1 022354a895073b6774f08f462fb0fd8e203c395c
SHA512 872e2cc841ac7deaf83585af77a00f7ab99d3e83b49979e20b2b6436f908aa2f141683025790b535b39df4749ba9522640e8da24620ff7e12d3ed8b25015a3ad
SSDEEP 384:OOoPQE9Ne+6wL/gOAil4s0VC0YlPtwTCDgRVMbMhI/nCaxxBsDcsSV4y0Ft:M9Q+lLIqlCULkCUSysnNxxBsDbuCFt
TLSH
T131C2A7D96CE0233ECB87857336320550EFF65547D68A326E948BB3182DF62D90F869E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb553762-d21a-4af3-bb8b-e4773a21dc10.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\cb553762-d21a-4af3-bb8b-e4773a21dc10.tmp
Size 27KB
SHA256 05aaedf0ef4b3a85fd88d2acf428e8077101e8b65c2838425b06499026c5446a
MD5 21d40834a66f9d5d26a30f2eded0df59
SHA1 69f080e17ebbf47ea38812f1e90cd0c45cda1dce
SHA512 8448dcbc6f9d63ddeacc7e624f8c83624df0a7d8f477496b50020216559bf12a0766b8d5cf99e0183c5845039a02c1640093d583a897e74ae920901b2b32486f
SSDEEP 768:LVhzXAh+Df4sONxEqhRi9I3ll5AUtewWTYYHq:Eh+nOYITjyT
TLSH
T113C202878D501081CC1E3F7E52BA7A6DAA2EDD71F7D4740204E87B27AAB7D44113DA2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd2331dd-13bd-454f-b377-43043abf7289.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\dd2331dd-13bd-454f-b377-43043abf7289.tmp
Size 27KB
SHA256 feaf3a74474a587cb36533669bca5c41c9d832d864a768a7ca92294efc4b2cc5
MD5 a3ff5cbd6cc87d6f7e6a41d7cad0b7c1
SHA1 4eba2338f6c6189bb8358dd0077417060cc7def3
SHA512 afcc26b03be1dc5763fabc416739de9149ea494effa081906721e5ae0a03daa850dcf9f59915c9b2dc1e45bd242e53d4a4d07b8d699e458edcbcde28735afee9
SSDEEP 768:XkcSn3QDN5VR+iYicYtFHHLa5QJVU6WTxS2OFAjmUjezWo7KNH0H01TadcztszPS:XkcS3QDN5VR+iYicYtdHLa5QJV5WTxS4
TLSH
T1E3C2DF6B7708FE81DA6472F78D09D689D225BCB9B1548EC5FAC373261C82432693F8C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6f592a3-d29a-4968-82f3-1ba0f8552799.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\f6f592a3-d29a-4968-82f3-1ba0f8552799.tmp
Size 27KB
SHA256 5436a36983430d231ec10ae06833738ee134e5da036b0cf4d61ea54f50acd75c
MD5 30b21231c5075d28f60eb58716850969
SHA1 7f1b07508c1ba8ffabc72931542b6fdf5edeedc9
SHA512 234ed1c69631e0a04e73a5ed9af2846fb0868e352ae43d52f75ab4bb724aa99fea3d881a5fc1e0debe12575d059a7a88ce80390cee4074d18353762442ecd01c
SSDEEP 768:NXN2k7oKJ42JYxGpgRVFBacGSK7+KRV6iAlr5AbkF:5Uk7xJ4IwGpijSFRV67R5
TLSH
T161C20CC28FC595DCC1896674A537830683AF93BC02B5195A6DEDECD3AE8E483103BF55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
Size 2KB
SHA256 6c6b80bbdda7411e5203165cca0fdf0203e0f9d9833d5046b4b16076ebea3a82
MD5 4509a649927c892232abb811fd07b9cc
SHA1 dfe354cce9dd3722bdc5b0c2c50edf209e60e699
SHA512 1a4d572046f5473ba148e3fcfd25c7c7a47efb28bf1f565f8783ab1dabcff2794aaac2007f774d139a08f5227723565fbaf3065499635d5c10276b3f75c8baef
TLSH
T185519CF683F4962DC92252F1EA246E1BCE5D0915836C3C2BC9D4BF1793E24B0E150B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

ae95bb0e-b4af-48b4-baf4-9076c90081f6.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\ae95bb0e-b4af-48b4-baf4-9076c90081f6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e1b0af61-0393-454c-90a3-06c959239339.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\e1b0af61-0393-454c-90a3-06c959239339.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 11KB
SHA256 ce36146e50143e2189e5d4d4ca668f793db6c66870d59a8e05a32214da8578d0
MD5 f9e74cc0d1004ac2fb397cf7afd20266
SHA1 fd91a945da2952690ae7aa4b224ebcd1ddd2e704
SHA512 d6adf26d6067eaad1221e36f3003f1cec3e6ae5862853373a9542793b39f2568243366b8a51554cbe99a8d56830e13ba1beffcf5866b0c9663b5cc00910dacdd
SSDEEP 192:DOiF7Hnf2Ug8XMyxLX4EntBSfdfDiew3lzFDsBQ0b+WNOvc7C7CbyIsn2agr4M:bXcEkCmxrJ
TLSH
T1D132218E99245DBB0DCAE5A5E619F72BF3E40020B5616DF4B7FD982C04CB6DC6022983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 15KB
SHA256 3fbaf369b9b3b0d5baeec5206f08042860907b5f20aaf1553f24de056bb9f96e
MD5 e7435d690f59f6997da30ad17fbb5437
SHA1 4001e3c3b9ee1f5facf887b959aaab688d84f4e0
SHA512 2350013430d8b29bde2ef10ef3ca6785123c2f00690a606d33c18212b340d81e42e2c7f10946bd30d723e491db86213751a7b2895feb1ac88f408437d08cbce6
SSDEEP 192:H7ON3BbdxV6B2L8jNeopZjBdXKZid8CF7Hnf2Ug8XMyxLX4EntBSfdfDiew3lzFm:HBJXcSAWskC9fZzhpj
TLSH
T1A96244CEE4205DBA09DAE57AE658F72AF6D10050E6706DF4B7FEE82C00C72DD64129C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 15KB
SHA256 5c03ddaeaf35cf819f155148cd48c96ed42d2b2c4f99a8e9ddbca2a89d63613b
MD5 3ace275854c0d01ad1fd35e7059a58c7
SHA1 73fcc7aede9219057d37fd4f5fa7efbf86beff5f
SHA512 3d9ff155a577525d7d62354b981b3d1216ea285b8b6b60956bc02f32144772c6627a211743a8b763ff5bf2797b4a8f4b3bab4070659c6d54b13554aae1cf8561
SSDEEP 192:H0ON3BbdxV6B2L8jNeopZjBdXKZid8CF7Hnf2Ug8XMyxLX4EntBSfdfDiew3lzFC:H2JXcSAWskC9fZ9hpj
TLSH
T1D57244CEE4205DBA09DAE57AE658F72AF2D10050E6706DF4B7FEE82C10C72DD64129C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 15KB
SHA256 4b4b49dc552798991a1a4530ede48e104e5f97d1959451c66183b5b7c7eb22bc
MD5 f6a2c54bca431723b9cfc4fa6ec57238
SHA1 9aa0da81923516006a0534fac3af4926f8fc9949
SHA512 d20a31d8a22fca9f7aff8237e1caced434474cead2de52e53748bc90a98e8459c031f7c4509efc3bbd2bbeeb7066917b7146a50a36d93c5b3e765b93f25ff486
SSDEEP 192:HcON3BbdxV6B2L8jNeopZjBdXKZid8CF7Hnf2Ug8XMyxLX4EntBSfdfDiew3lzFi:HOJXcSAWykC9f3zhpj
TLSH
T1FF7243CEE4205DBA09DAE57AE658F72AF2D10050E6706DF4B7FEE82C10C72DD64129C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 16KB
SHA256 37539aa5fa134b6bb36bfdab9f7631ac7565e675999e434c3d653de8742b5ce2
MD5 883e1039a24bb8bad89ed94a25fc2c44
SHA1 bd1084722e081b8d979caf492760491acd939f6d
SHA512 53abbd0020b70508c140d7400f1c9f692257d5505a95dce01aecd2e72a13cff4eff200dd48c529855935a07719f113a9f17efbd4355d9fe865a4e7dc9006dc29
SSDEEP 192:5j6ON3BbdxV6B2L8jNeopZjBdXKZid8CF7Hnf2Ug8XMyxLX4EntBSfdfDiew3lzu:5jQJXcSAWXkC9fCzhpj
TLSH
T1A272438EE4245DBB09DAE57AE658F72AF2D10050A6706DF4B7FEE82C10C72DD60129C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
Size 90KB
SHA256 41fb0511e785bd36045b3df17204a3f7968ddf4339145336e235eda7a789dc7a
MD5 14a6db0e1103a9175e6396ff120aed5d
SHA1 cad440a84780d9850b0fed45091eef3cbf75a7df
SHA512 ce33848d9927da5a1511410bdde448cefc27b99dd0b2a36898eaed4feb62042a35784e590534b7ab568f0ddf99217a3ba503623538fdd48f4df6124e69d077e1
SSDEEP 1536:2HaHl6YlHYXhH1wHjaW4Hiu/HfXHVISH9HwUHtkXCHMCkvocXTZH5HEsOfDUHJ9A:4XHF+A0yCWYATs8GC/n
TLSH
T1B793D8E6CCCD5E758FC9CBF8DC36A71B99940045AFEC9E14A7FA804C4386685213F686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
Size 115KB
SHA256 a67bcb17c95f0086447d131b7d94892c1ac1c4dd74c202f6b08e68f30f5dc01c
MD5 6616510fcd1ea9d11d376f1e591f21d5
SHA1 4b7706e5c519548a079529058baccfab76ef6c4b
SHA512 b4da81d3e2cc4fc96b464c067278c6ebe5dffa390ff11afc68e3cafab764d7339f33dfa0cb88212835b5ad60f55a8665639f1638181cd1d09fdd5631e180e4c3
SSDEEP 3072:XEYwfdsI7KXHh+y8layCWYATs8GVJkFz9:0YYIZxU
TLSH
T1F0B3E8EACCCD9E758ED88BF8DC3AAB1B88940155AF9C5F1497FE404C4386689213F587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73788ce5-15d8-4943-b5ef-85ac0cf4e75c.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\73788ce5-15d8-4943-b5ef-85ac0cf4e75c.tmp
Size 72B
SHA256 a424624d39acf0752b16b7a31b02ddd4dcb177f3a01f1e92bd9fea8c2aff68af
MD5 c560238988abbe886a76e41ec9dd6bd9
SHA1 dcf2504bda31ed547df9ee81279416d11777a330
SHA512 93de694a6338effd22d1316cac512cc430ae52b634b2b4943c6827078c6d0dc34ed913034bad3c7403163c2eccb8cc1917a53537901e31a5eeb0ed3bd4b618e0
TLSH
T1FEA0022902809110E24303B06801C38C1600FA799404022376F0434ACCA01514953556
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 360B
SHA256 a8c3468d2a541e7e663136e4f873239d175845bd4dc639c6b3488dc0f4817c63
MD5 fab81e2207c63be9eac22f643e97438a
SHA1 e8121892f083f9ae6d1fabdedf7dda38cd6a6d08
SHA512 6bf3430612d88fb538e2ecf99e62f6a73bd63359e30dfecdaf5cd22848000624b3fc34cb1defec846d9b6f6cd1f395411b7521f2254af44c87f46049780bdbb4
TLSH
T1C0E09703C7082CCBF06A933C270B00E2333AC8B7EB0917AA003820266CF46231D2A008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 be7d7499ed677744e634cd59c11c7a5f2bc47bdf42c88deaa2d6d91c6001a201
MD5 78e70935942fcec79330de1a410cc7c0
SHA1 3c5393d177073f6595d052c770093824a3e8b2d9
SHA512 8fb448502de71d973e28f4958814b93e9a1eab34ba4f49a3ffde9f12edf67e82dfc81add6fbbdd4d429a7db65f5bcfc8a8364b5bd2aeb5ba30c94d65d1925346
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7f1aef4865887218c1303bf9fe1a65f7dca68d854f1d858351431d6ed5af7835
MD5 791422f21162d4f89c98ddc11fec7e77
SHA1 296cf79faedf1c327c64a09a1651d5e20ced9185
SHA512 505df3100c7844f6ac047f76501bd92d69c611390e828607857af6d880b3a0ca9c23280777bf3b10e17af2bbebe9be4282ef227c8af7e7d8fb6d4747a26bf6fc
TLSH
T187A00210035D9083F45D077178C999D87340F82190000307B4E5B3968EA20519F43145
MD5 SHA1 SHA512 TLSH

Submit Download

082d6341-ca6d-4f70-ac9e-aaa727b919a3.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\082d6341-ca6d-4f70-ac9e-aaa727b919a3.tmp
Size 381B
SHA256 eaa212be038d96ebc93fe777f4943f2ddb91a592c68e77d2a25c9f70c4b5c7a5
MD5 e6b45a7c5ac34550c279da2ed7888c58
SHA1 324cadb54f2b446608b760df0f6a2a5c59d2fe1b
SHA512 c3a49454e2175a684dc422e9d41e417836459a1b0e5a7787ff7759379fdac25ea7171cd69bb5cb80ff706b79f5ca8126c501ba7116d6e9c3385825c959abc040
TLSH
T1C4E0F85808F693828BE301C60A1B9CA53AAE92A0010A89E840851B7ADD7480E2C90D2A
MD5 SHA1 SHA512 TLSH

Submit Download

70da728e-dcad-4f21-a739-b16da988201f.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\70da728e-dcad-4f21-a739-b16da988201f.tmp
Size 381B
SHA256 3806ea671755aad1ec635704a7de50f890599785257900114ea3f13f56513b1a
MD5 796534983af1b9ac6c14ad1d1bf025f4
SHA1 b1d339333480d1f6fc868dd699de1ea55321450f
SHA512 44f3e0e142a4dff0a7bc994baf75db2e6fc6216181b84a0125f0dede78150baef893119d308d260eaf935b694622ab8aa98c491a7b34a90b60d6f50ddfe14acb
TLSH
T110E06188B5215634C29D29CD68CF7F415143CAE5372112551D9117F0B6276011C7A97A
MD5 SHA1 SHA512 TLSH

Submit Download

76e5cf00-9587-49be-a7b4-9daced4e5230.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\76e5cf00-9587-49be-a7b4-9daced4e5230.tmp
Size 381B
SHA256 ce39051de683801029eaa8e744043b85e4dae5a41d852295658b109081c1a79c
MD5 b32141e7c3ad4ff7ba32fb61c7d31d26
SHA1 3a7ca9d021c1b89229924d3ce53d0286f6b50cd6
SHA512 fa228af558cbaa28a741f0e71519d299751a41a06c808e4fd4c843100bacfd5f159316d0ef7cc5ee4051557d989b63b233af690b888ace2bf762e7626b3d3be4
TLSH
T1CAE0CABC6DC0355DB1E743A61034387054519BD5555FE241146919B0DBB5DD301511D4
MD5 SHA1 SHA512 TLSH

Submit Download

da31249b-bb2f-49cd-aa40-2753f13453bd.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\da31249b-bb2f-49cd-aa40-2753f13453bd.tmp
Size 9KB
SHA256 9831c3f62bc7e4eba7ab0a0bc8bc81110ce5f350c61609d594ec6f7f47f7d87a
MD5 172faa592acd938dc915d3861adae6b4
SHA1 6948f19f38dcf972f22c5f1bb6fe0b5b4b9f7944
SHA512 202a839891d63c4c7cec02765f2f698a115d7c98eae61ee63385dfc54eecd4bf1368dbba1c3a0994822b55ac0189718efc0c6a3d487a15c0c3e6c0cb240fa6e5
SSDEEP 192:R6ZDo2wXJ5Halu0scqONHn9AEm6Ykz8QTVAqzkyLeZjnJHbu7/V0jEXAIUrgSChE:R6ZOJ5HIn59dm6Y1ISuZLeZVHbO0jEXC
TLSH
T11812BF8A4F7F4FF69B1474D1366BB12C532265A56523E7D2BC022691C51D8057F80993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download