Overview

overview

8

Static

static

8

TLauncher-....1.exe

windows10-2004-x64

8

TLauncher-....1.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/08/2026, 22:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TLauncher-Installer-1.9.5.1.exe
  • Size 25.5MB
  • Sample260814-2hrcbashqh
  • SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Checks computer location settings 2 TTPs 23 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 46 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-889581200-2041691093-2048517887-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1416
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-889581200-2041691093-2048517887-1000"
          4⤵
          • Downloads MZ/PE file
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4328
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1940
            • C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe
              C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe --silent --allusers=0 --server-tracking-blob=YzU1MDMyYTk2MjdiMGIyODU2MTM5YTU0Nzk4OWViYjkyMTdlMzA4MzYyMWRhMTgxZmE0Mzg0ZDIzZWQzMThlZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInRpbWVzdGFtcCI6IjE3ODY3NDY5OTkuMjE3NSIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiYTRlY2ZjOTktMGZkNC00YmE3LTk1YTYtMTRmOTM4YWFjZWYyIn0=
              6⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • Enumerates connected drives
              • Enumerates system info in registry
              • Modifies system certificate store
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3784
              • C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe
                C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.55 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff7eeabbd88,0x7ff7eeabbd94,0x7ff7eeabbda0
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:936
              • C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\installer.exe" --version
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4164
              • C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3784 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_20260814233639" --session-guid=aae1de9f-6db3-41b2-a531-b035f8a8fd3d --server-tracking-blob="OTA2NGFlMTE4M2QzYzc3ODJmNWIyODRmMDlhZmU0MTllOGRjY2NiZWUzNjY3ZjkwNjk1ZTg2NjZkYzAxN2ZkNzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4Njc0Njk5OS4yMTc1IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiJhNGVjZmM5OS0wZmQ0LTRiYTctOTVhNi0xNGY5MzhhYWNlZjIifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6408000000000000
                7⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Enumerates system info in registry
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1756
                • C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.55 --initial-client-data=0x28c,0x290,0x294,0x25c,0x298,0x7ff7eeabbd88,0x7ff7eeabbd94,0x7ff7eeabbda0
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:472
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe" --backend --initial-pid=3784 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391" --session-guid=aae1de9f-6db3-41b2-a531-b035f8a8fd3d --server-tracking-blob="OTA2NGFlMTE4M2QzYzc3ODJmNWIyODRmMDlhZmU0MTllOGRjY2NiZWUzNjY3ZjkwNjk1ZTg2NjZkYzAxN2ZkNzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4Njc0Njk5OS4yMTc1IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiJhNGVjZmM5OS0wZmQ0LTRiYTctOTVhNi0xNGY5MzhhYWNlZjIifQ== " --silent --desktopshortcut=1 --install-subfolder=134.0.5954.44
                  8⤵
                  • Executes dropped EXE
                  • Enumerates connected drives
                  • Enumerates system info in registry
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:6196
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff711a2bd88,0x7ff711a2bd94,0x7ff711a2bda0
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:6036
                  • C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Suspicious use of WriteProcessMemory
                    PID:6576
                    • C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xd7cb80,0xd7cb8c,0xd7cb98
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:6596
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:6684
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x23c,0x240,0x244,0xc0,0x248,0xbfcb80,0xbfcb8c,0xbfcb98
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:6708
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Enumerates system info in registry
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:6796
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:6812
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffa71996310,0x7ffa71996320,0x7ffa71996330
                            13⤵
                            • Executes dropped EXE
                            PID:6880
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:6980
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x160,0x194,0x198,0x100,0x190,0x7ffa71996310,0x7ffa71996320,0x7ffa71996330
                            13⤵
                            • Executes dropped EXE
                            PID:7016
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x27c,0x280,0x284,0x23c,0x288,0xd5e2bc,0xd5e2c8,0xd5e2d4
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:7124
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:7144
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x1a0,0x1a4,0x19c,0x16c,0x198,0x7ffa71996310,0x7ffa71996320,0x7ffa71996330
                              14⤵
                              • Executes dropped EXE
                              PID:7160
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:4468
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x190,0x194,0x18c,0x15c,0x188,0x7ffa71996310,0x7ffa71996320,0x7ffa71996330
                              14⤵
                              • Executes dropped EXE
                              PID:2812
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:1820
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x1a0,0x1a4,0x1a8,0x19c,0x1ac,0x7ffa71996310,0x7ffa71996320,0x7ffa71996330
                              14⤵
                              • Executes dropped EXE
                              PID:4840
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:7028
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x164,0x168,0x170,0x160,0x16c,0x7ffa71996310,0x7ffa71996320,0x7ffa71996330
                      10⤵
                      • Executes dropped EXE
                      PID:7052
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1704,i,17860222836484851696,17097631304596754738,262144 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:2
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:832
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=2152,i,956118786930476690,8027433438968369919,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2156 /prefetch:3
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Time Discovery
                      • Enumerates system info in registry
                      PID:1296
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=2428,i,12982533808281176817,6501877187292420563,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2440 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4284
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=3360,i,11211411826039594025,8083171235374573200,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3036 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5344
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=3196,i,4417009424534158389,5401204160022428790,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3420 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5284
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=3368,i,15611389146575747982,12961023457122157888,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3436 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5308
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=3388,i,5244624987958867627,12400555221211961801,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3468 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:1828
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=3400,i,2981083688878096291,4108878505970332201,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3484 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:840
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=3416,i,17842266951058098872,6534517265091761265,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3496 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3716
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4052,i,3491654428723151635,12837595274143868316,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4112 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5368
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_gx_splash.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                      10⤵
                      • Executes dropped EXE
                      PID:6008
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4572,i,15296537421980519656,7536588790011944114,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4628 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:6092
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4808,i,8618119596712090965,3744253769379818033,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4824 /prefetch:2
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:6164
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4980,i,6026466222481591300,18285925292276667597,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4988 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:6264
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5228,i,9129297965425202901,463119278231618667,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5200 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      PID:6276
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=5336,i,7203573572341908621,10340384362496661491,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5352 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6288
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=5340,i,17916830136119525783,14038813038953376197,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5360 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6300
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=5344,i,15593085072752810961,4382746305614752215,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=1868 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6308
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=5356,i,14894268882010620068,8345434615439130186,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5420 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:6316
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5972,i,13549602748540605374,504820311464513170,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5980 /prefetch:2
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      PID:6544
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6368,i,11771687828411450640,914275439368834937,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6388 /prefetch:2
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6664
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6488,i,14828827117303194403,4614477623563213290,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6532 /prefetch:2
                      10⤵
                      • Checks computer location settings
                      • Enumerates system info in registry
                      PID:6692
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6172,i,13840998133707196785,4233848853595405408,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6176 /prefetch:1
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      PID:6328
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7096,i,9312968614721906955,15643186103651137367,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7128 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:2272
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7368,i,1464834759111021957,9267238866182381267,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7348 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:6232
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7316,i,1612073264923434733,16668281680419248518,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7340 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:4616
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7300,i,14666283674744640828,3908247616397730480,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7648 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:5544
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7352,i,11811496626984672499,5279640580168106104,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7668 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:5896
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7336,i,15008575043054493608,8940176122024528878,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7688 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:1480
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8064,i,733572602831152617,16276291196613515680,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8056 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      PID:5140
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8208,i,16033097786446354632,662715753179539398,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8240 /prefetch:8
                      10⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6420
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8232,i,5246538750400697309,1884029739453152121,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8220 /prefetch:8
                      10⤵
                        PID:5840
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8600,i,13492907138040225892,8761388470013536675,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8676 /prefetch:2
                        10⤵
                        • Checks computer location settings
                        • Enumerates system info in registry
                        PID:5988
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8812,i,11804878087721647574,9887749301391861864,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8828 /prefetch:8
                        10⤵
                        • Enumerates system info in registry
                        PID:5928
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8844,i,18428567490593851719,12268428124110185993,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8964 /prefetch:8
                        10⤵
                        • Enumerates system info in registry
                        PID:5676
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9104,i,2856892424156189261,14251373727216102611,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9428 /prefetch:8
                        10⤵
                          PID:7484
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9416,i,2249692316945814462,14056123438784831750,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9568 /prefetch:8
                          10⤵
                            PID:7520
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9712,i,15320529462859908320,12648176953972610278,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9736 /prefetch:8
                            10⤵
                            • Enumerates system info in registry
                            PID:7876
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9892,i,4795441965249543992,9744438373799844159,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9876 /prefetch:8
                            10⤵
                              PID:8024
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                              10⤵
                              • Enumerates system info in registry
                              PID:6992
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x274,0x298,0x29c,0x270,0x2a0,0x7ff6234738d0,0x7ff6234738dc,0x7ff6234738e8
                                11⤵
                                  PID:5412
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8604,i,8215445261543214027,15010299014372481252,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=8656 /prefetch:1
                                10⤵
                                • Checks computer location settings
                                • Enumerates system info in registry
                                PID:7684
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=3348,i,15055943328318423424,2002268600190440579,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=3692 /prefetch:8
                                10⤵
                                • Enumerates system info in registry
                                PID:640
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe" --fix-taskbar-pins
                                10⤵
                                  PID:3760
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff711a2bd88,0x7ff711a2bd94,0x7ff711a2bda0
                                    11⤵
                                      PID:7180
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=10364,i,15312251035360546930,12509029442537829360,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10372 /prefetch:8
                                    10⤵
                                      PID:7312
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=5660,i,13969479600328235750,1728861607209266848,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=4072 /prefetch:8
                                      10⤵
                                      • Enumerates system info in registry
                                      PID:7404
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8128,i,4957811492208721264,3724368540591278378,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=8124 /prefetch:8
                                      10⤵
                                        PID:7960
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9540,i,11160350095110946002,4003259173014957339,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=8396 /prefetch:8
                                        10⤵
                                        • Enumerates system info in registry
                                        PID:5004
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7932,i,7221340449269880530,11364509074701865412,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=9584 /prefetch:8
                                        10⤵
                                        • Enumerates system info in registry
                                        PID:6496
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7644,i,13515895983952834279,4540539669339619006,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=8244 /prefetch:8
                                        10⤵
                                        • Enumerates system info in registry
                                        PID:5568
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8272,i,15015596183441722378,16643589758286637368,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=8468 /prefetch:8
                                        10⤵
                                          PID:7344
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=6496,i,6156909439779899404,4063808012432346055,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=8908 /prefetch:8
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7560
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7992,i,1373244991545451961,9226684340863216891,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=7984 /prefetch:8
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7292
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8920,i,6165169363878110511,2322348589222739591,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=8236 /prefetch:8
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:5512
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9656,i,12372916492706986140,5145462687421602284,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=9644 /prefetch:8
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:5644
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9044,i,7652951438352107064,7753261597538692767,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=9536 /prefetch:8
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:7476
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=4044,i,12034887463125556015,17975914006370227817,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=5644 /prefetch:2
                                          10⤵
                                          • Checks computer location settings
                                          • Enumerates system info in registry
                                          PID:7712
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=5800,i,10993908882855447654,9563229102717555259,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=6112 /prefetch:8
                                          10⤵
                                          • Enumerates system info in registry
                                          PID:400
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=10376,i,13140534224298241683,4719951098588621765,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=10008 /prefetch:8
                                          10⤵
                                            PID:2656
                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9092,i,8661955091978442343,2498444648121211291,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=5864 /prefetch:8
                                            10⤵
                                            • Enumerates system info in registry
                                            PID:652
                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=10476,i,12185215711642865647,12132784910319463198,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=5652 /prefetch:8
                                            10⤵
                                              PID:7308
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=7584,i,15178395180600433202,10256724426114150675,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=5360 /prefetch:8
                                              10⤵
                                              • Enumerates system info in registry
                                              PID:7976
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=9944,i,7075690348114361816,13547763028907848132,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=9908 /prefetch:8
                                              10⤵
                                              • Enumerates system info in registry
                                              PID:6292
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --metrics-shmem-handle=8960,i,12241875031021826589,1116762449191972570,524288 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=10096 /prefetch:8
                                              10⤵
                                              • Enumerates system info in registry
                                              PID:7984
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=4180,i,16081301515471881798,5162881284175324662,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=3532 /prefetch:2
                                              10⤵
                                              • Checks computer location settings
                                              PID:7176
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=3528,i,7845971153546767201,13598270239554012764,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=3564 /prefetch:2
                                              10⤵
                                              • Checks computer location settings
                                              PID:5772
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7440,i,13318522759412165056,9940529757517730707,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=7472 /prefetch:2
                                              10⤵
                                              • Checks computer location settings
                                              • Enumerates system info in registry
                                              PID:2520
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=7912,i,1821399664506418048,6314711627255468101,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=3912 /prefetch:2
                                              10⤵
                                              • Checks computer location settings
                                              • Enumerates system info in registry
                                              PID:7544
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=9000,i,8789737326346331226,12721537314598370828,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=4032 /prefetch:2
                                              10⤵
                                              • Checks computer location settings
                                              • Enumerates system info in registry
                                              PID:5304
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 OPR/134.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-profiles-streamlabs-promo=off --with-feature:gx-streamlabs-promo-text=on --with-feature:gx-widgets-mission=off --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-off:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=3816,i,4842003659395004942,59000406733496233,2097152 --field-trial-handle=1888,i,5815872937081277349,3751166322345550517,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1920,i,9152361222739895217,9896261879983436631,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=9028 /prefetch:2
                                              10⤵
                                              • Checks computer location settings
                                              • Enumerates system info in registry
                                              PID:3984
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2344
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe" --version
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Enumerates system info in registry
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:5212
                                        • C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe
                                          "C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xd7cb80,0xd7cb8c,0xd7cb98
                                          8⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5288
                          • C:\Windows\SysWOW64\DllHost.exe
                            C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
                            1⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:6504
                          • C:\Windows\system32\wbem\unsecapp.exe
                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                            1⤵
                              PID:3796
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Enumerates system info in registry
                              • Suspicious use of WriteProcessMemory
                              PID:5924
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x184,0x188,0x18c,0x180,0x190,0x7ffa71996310,0x7ffa71996320,0x7ffa71996330
                                2⤵
                                • Executes dropped EXE
                                PID:5916
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                              1⤵
                              • Enumerates system info in registry
                              PID:7148
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x274,0x278,0x27c,0x210,0x280,0x7ff6234738d0,0x7ff6234738dc,0x7ff6234738e8
                                2⤵
                                  PID:6332
                                • C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe" --version
                                  2⤵
                                    PID:3616

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Component Object Model Hijacking

                                      1
                                      T1546.015

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Component Object Model Hijacking

                                      1
                                      T1546.015

                                      Defense Evasion

                                      Modify Registry

                                      3
                                      T1112

                                      Subvert Trust Controls

                                      1
                                      T1553

                                      Install Root Certificate

                                      1
                                      T1553.004

                                      Credential Access

                                      Credentials from Password Stores

                                      1
                                      T1555

                                      Credentials from Web Browsers

                                      1
                                      T1555.003

                                      Unsecured Credentials

                                      1
                                      T1552

                                      Credentials In Files

                                      1
                                      T1552.001

                                      Discovery

                                      Peripheral Device Discovery

                                      1
                                      T1120

                                      Query Registry

                                      6
                                      T1012

                                      System Information Discovery

                                      5
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      System Time Discovery

                                      1
                                      T1124

                                      Lateral Movement

                                      Collection

                                      Data from Local System

                                      1
                                      T1005

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                      • Size 471B
                                      • SHA256 ca178ade85272cbf7d3f8c9e1efcd216eadbab55d8b9802aacbfe3e9c009dfdb
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                      • Size 416B
                                      • SHA256 1bc587c5f8375485475607b2bddba4a6115714a1a71f4de6106de7904369fcb3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      134.0.5954.44.manifest
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\134.0.5954.44.manifest
                                      • Size 225B
                                      • SHA256 46efe73f87240e9bc74ab16cb8c2147ed04e6a0baf2b668374f12d086570dabd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-100.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-100.png
                                      • Size 2KB
                                      • SHA256 9635c074c9d8edde0baf3111dbd7db49cbdc370c4f729c80ac382949f32be526
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-100_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-100_contrast-white.png
                                      • Size 1KB
                                      • SHA256 28ce8fcb22080ce1f69346cb0720bbe5662959e413426f00062b706013da8c28
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-140.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-140.png
                                      • Size 3KB
                                      • SHA256 a36a13a5d5e3d39e3018ccc5f8859944c87256f8be24a3c08a6bf3cb06a26804
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-140_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-140_contrast-white.png
                                      • Size 2KB
                                      • SHA256 0bd63fe653885286e180fbdf6d1dadc66af242b8ed6bd1d03d8c5eccc20e91d7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-180.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-180.png
                                      • Size 3KB
                                      • SHA256 6a8f64754c75edcc9abc1138e44acbd7064d7e8e2a28783939241dbd6afa30a5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-180_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-180_contrast-white.png
                                      • Size 3KB
                                      • SHA256 a706b332e6a846357a86c30d0e8bb7697e7dd55c2ae592dd45611ddce0c0bf14
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-80.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-80.png
                                      • Size 1KB
                                      • SHA256 7e6b0d9ea7fda1b5ca7a0b01290521dff943da4cbf1498412ca7d749db42c32d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      150x150Logo.scale-80_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\150x150Logo.scale-80_contrast-white.png
                                      • Size 1KB
                                      • SHA256 dfd1054f989cdee25f19ea792f363f042a125cab537a424f0224bbee13607e39
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-100.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-100.png
                                      • Size 1KB
                                      • SHA256 a333d7e4293f5269426b3fcb673a284f3708a66f957de62403b6570b24bae8f5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-100_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-100_contrast-white.png
                                      • Size 1KB
                                      • SHA256 ebbe0b4761ea8968a0a3fafb383ac7ae175e98cd31a0f41bdf5fcb43469b58ec
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-140.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-140.png
                                      • Size 1KB
                                      • SHA256 207519f1c7b6c7509bfeb7b55724997eec6456c8baf55e882e72fc5cd43da221
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-140_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-140_contrast-white.png
                                      • Size 1KB
                                      • SHA256 464afaf960c32abdc2c3937a48bf14c5d1a819b017e719fded591d43a65d94c4
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-180.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-180.png
                                      • Size 2KB
                                      • SHA256 d6367dbc074e37f3488c26b0bad229bfe99f5c6bb0e28d37b41906c436152b57
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-180_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-180_contrast-white.png
                                      • Size 2KB
                                      • SHA256 5d46e4056f3915c279f1fa9edf61d93529fbcae5c59d616380ec5d9405b7763d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-80.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-80.png
                                      • Size 1KB
                                      • SHA256 dc20e5aa2b500cd5b5c9f89647d3487810685c94268f22678e27820e2454bb3e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      70x70Logo.scale-80_contrast-white.png
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\Assets\70x70Logo.scale-80_contrast-white.png
                                      • Size 901B
                                      • SHA256 dd6f46d32c3e235508f9e4c7d7f993bd807d955bca7e63cf3d57c6c4c102f46d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      CChromaEditorLibrary64.dll
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\CChromaEditorLibrary64.dll
                                      • Size 145KB
                                      • SHA256 b8d511b48b055d0d4a12e16198b7111f04125878b8103d06cc42ab7e6412957e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      CUESDK.x64_2017.dll
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\CUESDK.x64_2017.dll
                                      • Size 474KB
                                      • SHA256 1980b41981766ae02f91b1f6dce532376effd1ae0d21d3834d20f2c26b42e83d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      assistant_package
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\assistant_package
                                      • Size 3.6MB
                                      • SHA256 fd971bc67cc49f02783fe605738cc3e57e76524280fcce2801480d85efa7ff91
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      d3dcompiler_47.dll
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\d3dcompiler_47.dll
                                      • Size 4.5MB
                                      • SHA256 9eb78ece429b7ff6f5bb28b28da09d4166e42b66699625a568883658ffbb8266
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      installer.exe
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\installer.exe
                                      • Size 9.1MB
                                      • SHA256 fdc0e6dc74ca331cab5d788994fa77edfb3889f3a53ba97be49270b72988ac1f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      custom_partner_content.json
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\134.0.5954.44\resources\custom_partner_content.json
                                      • Size 245KB
                                      • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      installer_prefs.json
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json
                                      • Size 1KB
                                      • SHA256 5ed5affe73732cc7faa6c853e568a6ff47cc541fd37e0fec9cb8f89060bd15d8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      opera.exe
                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      • Size 2.9MB
                                      • SHA256 f9a3e32e46d23c6d431684f04f178288a4aecb0fc8a3c1aa3ee09de4fe6727a6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Opera GX Browser.lnk
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\Opera GX Browser.lnk
                                      • Size 1KB
                                      • SHA256 d222ff4e0688e8af681de4dcd8370b51cc0d196dc5cc47679efe4472603a69a5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\Opera_GX_assistant_134.0.5954.44_Setup.exe_sfx.exe
                                      • Size 2.8MB
                                      • SHA256 70f1b1cbe5162fd8842c441779ef4d59de6b182d1448fc6285c6a73ae3033fc4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      assistant_installer.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\assistant_installer.exe
                                      • Size 2.4MB
                                      • SHA256 c5eef147beda944c8bff63591165b4c49e556d2c45c6ea9b9f1d9e16f180621e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      dbgcore.DLL
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\dbgcore.DLL
                                      • Size 196KB
                                      • SHA256 856a7e6aacf1934324f08dc42b4b37cb20886d933cc0c57283c8425f9ebedbdd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      dbghelp.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\assistant\dbghelp.dll
                                      • Size 1.8MB
                                      • SHA256 8f880333398382fea1efa73751f4b16d8204a60cc13aefc8c4223b8086eccd81
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      installer_prefs_include.json
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\installer_prefs_include.json
                                      • Size 242B
                                      • SHA256 40ea1fbf69784552a6aca6f03f95b7ec4c38332d39c88322835c70b661d643dd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      installer_prefs_include.json
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\installer_prefs_include.json
                                      • Size 955B
                                      • SHA256 758f48b70c52edde6d7708323350eac1038075a16837c34cb65e448f20cf143b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      installer_prefs_include.json.backup
                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\de27d864-4fa3-4159-ad4a-9c9f61412cfa Opera GX Installer Temp\opera_package_202608142336391\installer_prefs_include.json.backup
                                      • Size 227B
                                      • SHA256 97331f17409895395d817dd6dab7119ff107665a9f866a3c2926bfa9ada6b1b7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      installer.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS4970DC58\installer.exe
                                      • Size 9.1MB
                                      • SHA256 ec964a3aed41470a82bbde43181708cd08380d26707290d7246f3cab7b55bda0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      200.ico
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                      • Size 116KB
                                      • SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      BrowserInstaller.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
                                      • Size 3.7MB
                                      • SHA256 e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRIMG1.BMP
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                      • Size 12KB
                                      • SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRIMG14.PNG
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
                                      • Size 43KB
                                      • SHA256 6528bb11becf79c17c77a9c6624b82074b9dd6d3e932852c8fe1da22a57854aa
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRIMG15.PNG
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
                                      • Size 644B
                                      • SHA256 207bd7ad2eb7f48a2a1be1253363fa120ae79e25eacbd37d6b9be52d2128bfdd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      IRIMG2.BMP
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                      • Size 12KB
                                      • SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRIMG3.BMP
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                      • Size 12KB
                                      • SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRZip.lmd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                      • Size 400KB
                                      • SHA256 3a6794c90d69383bd76098992cb512ae343cb2e1a3680dd4794e49895472b429
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Wow64.lmd
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                      • Size 252KB
                                      • SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      irsetup.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                      • Size 1.8MB
                                      • SHA256 96070b2d82b6bffd54719f9753909be5f5151edbd5b37b26f50dea2e995ea430
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      lua5.3.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
                                      • Size 395KB
                                      • SHA256 eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      irsetup.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                      • Size 1.7MB
                                      • SHA256 ea04ee2883ca5dcb461ea894a4e2def7d0c89f11d9f06f3bae020f6a25e7b75d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      lua5.3.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.3.dll
                                      • Size 395KB
                                      • SHA256 0e43d22649d6b2ecbac9915dc6498fe1f41777dd33147d962b30dad0d5e76ab3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      opera-installer-bro.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                                      • Size 3.9MB
                                      • SHA256 e3b5f72a81a7dd1f520f626f706c21a970f42cc311e1716edb88f6cd37602754
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f48d228c-929a-4fd3-9277-ac820a769223.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_2031374139\f48d228c-929a-4fd3-9277-ac820a769223.tmp
                                      • Size 46KB
                                      • SHA256 8da8a260ef30654d2d2db425e4b7c9d6d6d43e1b94a6e8f4259cdfac9766fd25
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      8729c0f4-b2c2-4721-8057-961808a17b55.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_315259071\8729c0f4-b2c2-4721-8057-961808a17b55.tmp
                                      • Size 1.2MB
                                      • SHA256 bed9f6201cb62529abbb2f4ecab5df691936b73b577795171d0151e629ccf5e5
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      icon-57.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_315259071\CRX_INSTALL\icons\icon-57.png
                                      • Size 873B
                                      • SHA256 8462b976325b85e3fe1140685159792a700d5382f2307d5eb667af10e76d8964
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      31597c2a-0e89-4646-a0b3-f4053c358c0d.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_759774972\31597c2a-0e89-4646-a0b3-f4053c358c0d.tmp
                                      • Size 472KB
                                      • SHA256 4b9b79291aca9c45d54ae238655f41b7a0eecb0b80fb3d172cd0b1d75e712540
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      favicon_opera_one.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_796944074\CRX_INSTALL\favicon_opera_one.png
                                      • Size 2KB
                                      • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      b5ea1626-df8d-487d-975a-b78596d34641.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_796944074\b5ea1626-df8d-487d-975a-b78596d34641.tmp
                                      • Size 4.5MB
                                      • SHA256 e6fe1d0435bb298e77f9f1f362f538d7502694944357a97b07cf659d52f140c8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      main.js
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_823184262\CRX_INSTALL\main.js
                                      • Size 46KB
                                      • SHA256 e1b3123f37dfe988a8a22427e98d06cdf472c23429f6277f68c6eeb1626cd54e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ebed1f9c-081c-4901-96d1-a942dccaed11.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_823184262\ebed1f9c-081c-4901-96d1-a942dccaed11.tmp
                                      • Size 13KB
                                      • SHA256 35d78e805a910aad7462893e050376f9d18dbc73c592b4742e6ada87eff3f06b
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      783c9044-2cb7-407d-b8a4-099943340ee6.tmp
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_935871718\783c9044-2cb7-407d-b8a4-099943340ee6.tmp
                                      • Size 2.6MB
                                      • SHA256 71c7a508f591d1771979df4fb400556c4df21d8937e017e322ee1c4749dda428
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Icon_Light_Neutral.png
                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7028_935871718\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                      • Size 2KB
                                      • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      setuparguments.ini
                                      • Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                      • Size 801B
                                      • SHA256 db9824ee5ba38c649ac86962bf01eefdcea77edea8cf5f843faa838bc165fe55
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      IRIMG1.PNG
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG
                                      • Size 45KB
                                      • SHA256 a42ab4d62c5a5286202df15f9ad32b22396d5d12c7a4db8c5a2c98f90160ade1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRIMG10.PNG
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG
                                      • Size 206B
                                      • SHA256 348e3f3544cca4c9ca2af323fa8b3453a70ea421c82b331681dc1d4ef74921f3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      IRIMG13.PNG
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG13.PNG
                                      • Size 41KB
                                      • SHA256 1708790d5496b9cc325cc0249cfa272aac3c3738188fc41eef83e8592de247ff
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRIMG3.PNG
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG
                                      • Size 475B
                                      • SHA256 d339d7a5fcaff72292150f3c7db87a73caa396e23224b570e053c8bb96a3a897
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      IRIMG4.BMP
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.BMP
                                      • Size 451KB
                                      • SHA256 64da5bd044908b2c3a725c5a55edec1644be498f41ea05d42a6ae8cd797f1d80
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      IRIMG4.PNG
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
                                      • Size 368B
                                      • SHA256 3207283d0abc0dd36c0991b40a738247394bbc92e5696eb790a5c888a9f28106
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      IRIMG9.PNG
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG9.PNG
                                      • Size 438B
                                      • SHA256 d16a8eaf8f979e45bacbbd8ef14afe482d74e926dff2e87e569342874ba34145
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      uninstall.xml
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                      • Size 21KB
                                      • SHA256 a030da3437ddaf6f9cfe230255751bc5f3d8a6d446b26cb80103798513e9b9a4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      uninstall.xml
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                      • Size 21KB
                                      • SHA256 9d6ed7439983fd7046b62502d58f9c6f3efa0738de73c7da077418c5417b96c6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      uninstall.xml
                                      • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                      • Size 21KB
                                      • SHA256 9b0dd72651a64b38381b2618716fadb56980bdbc96c74037c1c264a1c87693b9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      a86039fea68ee3b1.customDestinations-ms
                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a86039fea68ee3b1.customDestinations-ms
                                      • Size 22KB
                                      • SHA256 9324040a4abf8b162a398dd07d8c89f342db8a2a1f8f5fdb456f25cd001ca0c4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      a86039fea68ee3b1.customDestinations-ms~RFe594107.TMP
                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a86039fea68ee3b1.customDestinations-ms~RFe594107.TMP
                                      • Size 22KB
                                      • SHA256 b2ff470d211f69fc834a17b26f7c0d64dde2c5ac2667dc91174590eb7b85714f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      settings.dat
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                      • Size 40B
                                      • SHA256 a650b2dcf91775d450851f78cd3313abbcd18a1487e215345bb882a437dda858
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      203510cc-cd4a-4af9-8b6c-f62849cf2945.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\203510cc-cd4a-4af9-8b6c-f62849cf2945.tmp
                                      • Size 171B
                                      • SHA256 3a358dda48cc46cd7addd38f7ec9473f911b49c83481d908fbfafc92af8cd771
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      245b2308-1bbc-4d7a-9f80-9d473a70b038.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\245b2308-1bbc-4d7a-9f80-9d473a70b038.tmp
                                      • Size 412B
                                      • SHA256 7b6f89aa933e690efe47621f90983f24604616b7b36109f15cc2d4b87c991213
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      662f0611-35ae-4697-9226-646c2b2ab52e.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\662f0611-35ae-4697-9226-646c2b2ab52e.tmp
                                      • Size 162KB
                                      • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                      • Size 2KB
                                      • SHA256 269d497e1e8c9866590e445511eac91c35e0703db46d8b24dd1bd8f11f1d233a
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                      • Size 48B
                                      • SHA256 1eb4049e2bfeffbe8d47602396fbb3f9f02c56051426a0feea26590f3a3df0fc
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      000001.dbtmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Scripts\000001.dbtmp
                                      • Size 16B
                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      MANIFEST-000001
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extension Scripts\MANIFEST-000001
                                      • Size 41B
                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      manifest.json
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\Temp\scoped_dir7028_2072805362\CRX_INSTALL\manifest.json
                                      • Size 1KB
                                      • SHA256 260b3142cfc312fac94098f84da9343a08e2a4d2e8e08d0e0fd4688ea261f4f8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      messages.json
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\_locales\en\messages.json
                                      • Size 2KB
                                      • SHA256 57e2b257a65fa5e980c619214ed9ae25580bbd581143e28abac49928b31977a6
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      background.js
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\background.js
                                      • Size 17KB
                                      • SHA256 c7a162a7650887dffe12034ddbba5ddb91ca5bf4f5478f59ded324f7e088bacb
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      twitch16.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch16.png
                                      • Size 370B
                                      • SHA256 6534efc770a8a32c881258029c2f2b9d9f1b75228f53bf9b4cd2b9a9689884e0
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      twitch48.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch48.png
                                      • Size 921B
                                      • SHA256 47e37c0726206401cc69cb6ab0fdda79b364356a5e2fdbd5ce479bfbb965f245
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      background.js
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\iadifhcoomlippfncokcbkajgmhjaglm\1.2.318_0\background.js
                                      • Size 373KB
                                      • SHA256 74d0ac015b7e9cbf5806db40de5c67977983012ead6b5d49b653dc973ba2033a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      icon-57.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\iadifhcoomlippfncokcbkajgmhjaglm\1.2.318_0\icons\icon-57.png
                                      • Size 863B
                                      • SHA256 7a1ae78e7cb77b74cbaefa5b92ec32384761499375738898e71bd43f018f3a17
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      logo_128.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_128.png
                                      • Size 7KB
                                      • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      logo_16.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_16.png
                                      • Size 653B
                                      • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      logo_32.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_32.png
                                      • Size 1KB
                                      • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      logo_48.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_48.png
                                      • Size 2KB
                                      • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      logo_64.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_64.png
                                      • Size 2KB
                                      • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      service-worker-loader.js
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\service-worker-loader.js
                                      • Size 49B
                                      • SHA256 f8eef7c260d4743817755ab4987619c18d1266f27d2435f32ad3f50494a9058e
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      favicon_opera_one.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.60.0.2_0\favicon_opera_one.png
                                      • Size 2KB
                                      • SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      reader_mode.js
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.60.0.2_0\reader_mode.js
                                      • Size 112KB
                                      • SHA256 f5b63ef3854271863b5f3d7c06b7a6c6b428bbf87dbb65378128731114c21ed8
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      service_worker.js
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.60.0.2_0\service_worker.js
                                      • Size 86KB
                                      • SHA256 8ae71ebc80ef0c58362515dbac615070e40a538758c2b25931cdcbf6e881a5e0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      spotify_frame_interceptor.js
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.60.0.2_0\spotify_frame_interceptor.js
                                      • Size 5KB
                                      • SHA256 2a56db49a693f567dfa82d3bb47a48565cb99b54ac51b70a00548edc2ab366f3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      background.js
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\background.js
                                      • Size 86KB
                                      • SHA256 bc24cb72eda19eaf9ee195f014bd6247e826cc594e73461b826c6bd0d5f50dce
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Icon_Light_Neutral.png
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Light_Neutral.png
                                      • Size 2KB
                                      • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      popup.js.LICENSE.txt
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\popup.js.LICENSE.txt
                                      • Size 1KB
                                      • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      rules.json
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\rules.json
                                      • Size 839B
                                      • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      MANIFEST-000001
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\IndexedDB\chrome-extension_jifbgnmbgbdiedhdecealmlgmekpagde_0.indexeddb.leveldb\MANIFEST-000001
                                      • Size 23B
                                      • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      325fecce-2431-45b2-9eb7-d6c16ac6b8b4.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\325fecce-2431-45b2-9eb7-d6c16ac6b8b4.tmp
                                      • Size 27KB
                                      • SHA256 353f070543d1c43247d565c23d4c0346a8d65d902aa7bae04c6ae5e64bc5cde7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      6e853ba6-eaad-48c6-a449-4f2410eb1297.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\6e853ba6-eaad-48c6-a449-4f2410eb1297.tmp
                                      • Size 27KB
                                      • SHA256 cc914b6c8be70f233d533244b1fe41e32c495b9bb57901a96777f7d19fd75dfa
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      70c85e44-51e3-4b20-909f-226554bc7b54.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\70c85e44-51e3-4b20-909f-226554bc7b54.tmp
                                      • Size 27KB
                                      • SHA256 2f1a860dec73e59307d1a8e1b1ace276076ef77008f468720569bfc8d7ba2512
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      b9550bb2-53b2-4915-964e-c438387d5610.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\b9550bb2-53b2-4915-964e-c438387d5610.tmp
                                      • Size 27KB
                                      • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      be0c9694-2acd-4d7c-a574-84f195ced75d.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\be0c9694-2acd-4d7c-a574-84f195ced75d.tmp
                                      • Size 27KB
                                      • SHA256 b79b047aa13202f575c92b513e67530ee9a5de4755d8d67c85c2f156c9a4eb39
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      5246d41b-8fbd-4154-b49a-db25693e9ade.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\5246d41b-8fbd-4154-b49a-db25693e9ade.tmp
                                      • Size 4KB
                                      • SHA256 e21b358cfc5af1d614f0fad61e74195b13b6a135ab6238bc86a633cc5774311d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      6840683e-a2cb-40d3-b47a-fd79311d4d7f.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\6840683e-a2cb-40d3-b47a-fd79311d4d7f.tmp
                                      • Size 59B
                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                      • Size 13KB
                                      • SHA256 8a6b7d25d64aef90debd9ad2285b277472c883e887d3bd53e67db8359cce31c6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                      • Size 12KB
                                      • SHA256 b8c2b592c218359d203e6662e5badb2e729c64c0c92feaa97c5597c61aab87ec
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Secure Preferences
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                      • Size 122KB
                                      • SHA256 1d2e2f0149b324d2268f316159f24133bfc88c04def5d8b9a08b8cd9ac177247
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Secure Preferences
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                      • Size 84KB
                                      • SHA256 a76c747672c60ada9fd4c789d85fc25341b759d7021e5dc95da620707bc40df2
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      007f2df4-7a16-4ad7-a108-164e40366565.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\007f2df4-7a16-4ad7-a108-164e40366565.tmp
                                      • Size 72B
                                      • SHA256 ab45e84cc790694d398d4bed5b1201d1bad3b39ddb6ea09b0bbfdb5006493877
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                      • Size 552B
                                      • SHA256 e8290470b081abc5ef32c8850c668731086ea6c577dc6dfae33c2129100f88aa
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      9997824e-61d4-4441-8205-0e58415e0661.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\9997824e-61d4-4441-8205-0e58415e0661.tmp
                                      • Size 381B
                                      • SHA256 06316a187febfd3b7ce41100a02794de2e6b1afbb7f3026f47539890eada0280
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 60abfabf6bdfec46132ed1e4c49794b01085fc8db9f7d19aab1d67d35f058afd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 10KB
                                      • SHA256 95a2c2d41b9cbe41cb183436a9edebaff0057a4ffa043153712deb498f2a112f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 7f079b8b84e418dd324202259fbb70f322e924673fee084d221d390122d50c02
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 f76a163ee51441e1793e3668b81ab803d8c8ea7ff14ff833ad85c48442f14360
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 733B
                                      • SHA256 9769398f1d6386adf5ccd573a167ee1f936bd93deb3e92762791b3479c2abfb3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 5a3fc9e74229351b9bf879d1452fd4cd95ba9a8edc463e98bd7fe592bce9841f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 2KB
                                      • SHA256 6c3f4d684db240749c4789b24a7a1c5b3051a715ae1c6e111b5456c55da1ee43
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 4ca71e117c2644c11fdbbd8874db7a19238ccc777a72df31221d7300eb516a44
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 56c56e914987676a5f2529021174a899a7973b3eed2e5e49b5becc286b9c565c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 63171bc35ab9d2c33dd5cf97ad717fa0c97a26a299c3538894e1bfc05c7e80e3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 12KB
                                      • SHA256 c342f730181cb435660ba496eae681696369e31bd90d556d44fc5d16505bf5f1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 12KB
                                      • SHA256 d7f8b837e4fd988cd48701b194595d2f4159b1939b0470f71b18f9d777cd433f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 493B
                                      • SHA256 4a819e5673f92b773261092bbe074f20ae4758b0a1b7aa91581c71225f6dba15
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 605B
                                      • SHA256 23e97e3640ebc476dc2ebd5b66eabcf8007ee6ab4d5a1b7e145e7fa19ed749a3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 ca58d4cce324fe9baa6ee8656cc75dfaf45a6d920482412a877a581058ae89c3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 c4db4bcb3e3d27dbab0dd9fde289d70cb7853efc2bc6d904ec34675c90322f5d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 4b20b5d83a38b4c232ae1ac9db440dc4014abaaa8ce3dbb5f87595f37825ef85
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 75a1ba02e4d5d5d073d15aa27aa7c20baa0233a7815233b5ad7cd885db93f05c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 e1fa8b286d8c7caa0f6850de937f5a3e0fb2dca1c796d186ed4ce7302b598c09
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 e2c5482d1b051fb234d794be651388f9e162c69556abf8459d28deb62dca9bd1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 dafc6044f5b8e379375e354c3949aa37594061f06f5017226ca3ea0e228b743b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 2KB
                                      • SHA256 a028f47b5ac6670b42a875cbcd338215cd5436696dc0d2a0ca6e254eeffca604
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 2KB
                                      • SHA256 5fca53fa5107c8841a13850d971f0380e9d6e7fbb6214af75bc2466fb9ae29ee
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 2KB
                                      • SHA256 6fd17405ade9096cd48a64178f659fa14de4230a5df628addee1c95993ed4ecf
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 2KB
                                      • SHA256 16d09bb259e3b8b6705d8bcbf9503e15157e7c88dd6cb716b516b392383f7bee
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 2KB
                                      • SHA256 203172c2c8e1dfae29dcaf60dcdfcec94198abdbe20b78830da65a78553dccd0
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 2KB
                                      • SHA256 8184bbc7635b417e497118f3c9dd82a95cebf2ba68580e5ad71978e89897cfba
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 a1360c6d843ae9c7a6ea371bce364c9b771c28ba8f096d7c93ae47309b0419dd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 2561ac90d4250802e8fea4202d112e8d4499a76f58cc06ff8a4b4610d5daabe0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 4c8f076b9de3bd4467bbc43bb122191bc6c292ba5fb9c53a9e29f2c6b90badd9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 5b2678f325d31cc6395a88f7d1d1d6e4d152bda450b5a3e18c927e8b1b45f1d7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 7845afd6da10282fd5429b71275bdce2bc12041e13673263fadd3d667eeb55aa
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 600c19d96477a536bdb4976b16ebdbafd7a0a3f94d2ceed30ace0af785076272
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 6b7f960cad07818ca61019868b1e22f265e85f8a617b09e0671e1c2787686e96
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 dad0a1a9fa9236d1e8cc0da1c7d8ab5cfd3dd1de53b77c27803715d0b3f24e07
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 6e3a38f116ff67005f238d2fb586e30f78d74db435d1f1b42351459a53d16f2e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 2daa8f47c84f4997493c82d0b2f06f6ab643e5c721f32ecebd0788578290fdc4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 6fbef76ad436090343cd3e9456959b486ce21a52fb9120ee246f6b5457eec419
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 3e107db49e79ec7d70c6bb55b128d5d69210bd62600d1515f0733eebf57a0277
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 9100b3cd37917084527d9f7c164c4816c5bf2cef6b88046ee9e6eba44c5937db
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 b16de0b1df98c4e672c41bc1e47ab8757d6f61c507c57d5ca39487b6e4549d14
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 4c542447333e47f9e44c41eae0dd4ae0498530a02de877bc4a1df8267ad2fae7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 c91cb1ef25260517781bb34afd1b271556765703b254fc8960c153530f3e7e3a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 dfedd71d3fabc4d4dfd93370ef466009a358b07ac7dd8ff2b59b2c9c25b76c00
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 26539f236883619d7ffbd6e09c5133e5ff293d66e95d5f36dc279680073ec1c6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 773a09e4425c4c09f1a4bd222c56fa0aede4154d04842bcd3e420b7898e82e98
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 a37e37e602ad674fa493791ebfa2f83c49a0b59265248058b209fc98cd1cc863
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 7bf46973844be9a5d4094468ed24d6f324434f160a87716bcd690bcc012e7594
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 12KB
                                      • SHA256 224cbc5a83bf1011e2237290c372e390dd39674722a4991cf8b0a3e3ae247d7f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 83b87046ed5022c22dc8128238751c787b2c9282fafab1240a8a624a4ea09c62
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 12KB
                                      • SHA256 abb9361b625992fab831f0fc3fab774b1c439cb754acce12d5211115684857f5
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 cb5c712c0a39e98618720dbbd597ca769d7b197685d080fd105056a8bb19d24c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 1KB
                                      • SHA256 ce9a4a4db4730c1e4e154ecd11492e405b8cf66e15f2db69821789c0b500a267
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 6aaaa4a50a3a28858087fa1ca17b706bb8a7fd96f0a3eb0431bf593a52cecd28
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 3c851af7c8ac1cf2a72fd7d1678c8dd681d841277caeb1551b4d287c9ce8d7fc
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 be70668b5b0d80a4038d2ebb02dfb0c282f476e10a804e6b02cd7a1c21d5ed9e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 ace632abbd1c4a5ba02716da53990062d20870c21a28b4af1c9e4b3e03529e50
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 ce0559615f57a242ca7777d08dff9911dd016dc2df198516047fe4f01b17e591
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 a94eeda51383c7ad2b65769f1090d552bd5048288e0963561f20ef3aef0140b4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 96469011aa305e98968ecc482e859a7ef91a2a897068c0894cda4f4e57895412
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 e951ff447e90c02aa6bc31dd87763b7f15887937a365d3d95d3a959937df2c92
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 909B
                                      • SHA256 c72e775068a7969d7b8d32a7bbc6f41d7a48970989b1496642dc2f9c4105bda1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 8KB
                                      • SHA256 5619608568625cfe0649b8cea3fed626e7f6302deffaa47c9d6465a595725fff
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 1fb2e0a40354a298206ea5e5a482a51e00f4932ff8a5ee2c5ae0f572ed4b3931
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 10KB
                                      • SHA256 d78001d5b353bb4f9e70730027921f1126d7c71c6eed75c10a0f137331b81ca7
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 12KB
                                      • SHA256 d9ab218997b81b5e7af80c3c9c86595a541d6aae352f98c292d3502a015a4856
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 9KB
                                      • SHA256 242870e2d2008738f388c6f98ecebfe1a08a006b9ce8de3761254c5fabac8353
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 af247ffb04d633ab1cbd8823c49d033eb37daf0527ee282415197b7ab607787f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_5b079924-0782-45f0-a48b-1bfca29dfec6.raw
                                      • Size 11KB
                                      • SHA256 c4cd6e0a52ed9524ecff4f70bffc20bc149296c6b249b7197d8fdcaa6b8bf447
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      e9465c1a-4b81-4ece-aa90-3acdc6567f7a.tmp
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\e9465c1a-4b81-4ece-aa90-3acdc6567f7a.tmp
                                      • Size 12KB
                                      • SHA256 5684dd07d0ab4c7b1f390da1f4609ac50c4ca0d98b7da2cd8ec451396588f538
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 a0211d47fe7d6437c37d7684edb4cfa54f9f96820504adb0f0f9315779789d9b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 35ea52327b1fce6b3a647cb6e62bcda919afc184dd258cc9adc192fba3641fc1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 2KB
                                      • SHA256 768cff07d7280b5d5cd9b33b7ffcbbd85afaee112dcc3955411b7107bba88090
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 6b4e74cf580ffe5dd08121a3104769602cae56442212944d96fbbb70fdde7d5b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 e308f4791abc04ad7db7f8daa2b2a4512ea88310a71ac06b20c94b795e066e70
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 87d1f78ede55436046e0da4e81570ff50c748eb7bae682af5dcc8c1adea12de4
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 805ca9c3eb794590a03d216f27893b2623543aea467903f0cc51fa4fdd806c71
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 b17f8c3717950bcd95aa24a9130dfc91929cca03dacaa57e1f4d0d65858bd275
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 644e6e74ce7f494fbdbf00d023a8661ef6790d9922f54508179a34419213c9af
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 58ef1be12cb84d44a1e536e13958f54c207ab038a91452d5c9d6d1088e6b4efa
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 b5e1aeddfb19ad5671b0168063bc9fcdaa55fcdfeff4664b370e3a5faa5c1f61
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 53281eeb4002ff3c55a28dad61936823d55bfbd469dfeef2c5c08cd56e3ec309
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 3KB
                                      • SHA256 71762966c216b7310308ce054b7e0c2e1f2a3696847e9292b691516c84327052
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 505B
                                      • SHA256 a1ba85cbe73d5a0bf101454d0d4db657236d4db03cdbdd128c3ba523067853e4
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 597B
                                      • SHA256 69e029f3dc25eb5a5f056dc6ae10551c8749c99d5e9a800815a3a17c563b9ad3
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 2c7cfc4073ce1bf39abe1df2a7fe6f6eecd324a5ffc566f24f55a32335091dfb
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 bfd647be8619a55affc7a9aa3793b06d8cffc74756f328af1afaf290045bdc75
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 608323b3b6b6b8c145b84562f0bf43cd53a5a9dcb4c322be180ead0320b029fe
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 1KB
                                      • SHA256 17cfb66eeb615e0097b9b892530d5cb0a1513ad07a605eab560e836258c83e7e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 690B
                                      • SHA256 16a4b13498b12e20f62ae70828fcfb946d900113b526527fe31d81876834dfed
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 779B
                                      • SHA256 d153447c9a56ef29a89f0afd088d4f1ce1b064642395b4256cb303277354927d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 870B
                                      • SHA256 3db13b5d33bb366e66a12b149e2ff4a369b7a3fd6925ecf879f30e12a219ee63
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.0.181105228
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.0.181105228
                                      • Size 963B
                                      • SHA256 8ef9cf92d27f4a60e97c2c180eae0b355b6b26155d02e86696dd1db6ec6a5094
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.1.725289280
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.1.725289280
                                      • Size 200B
                                      • SHA256 0e0c5ee0f5e6667824dbd356dd7fd85c58a704e5fd368903246b65817d3be222
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ssdfp7028.1.725289280
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp7028.1.725289280
                                      • Size 224B
                                      • SHA256 ef835d4ffe161271f635dd553192532e59c274394a633b05f652b23597a91a86
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      data_0
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0
                                      • Size 8KB
                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      data_1
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_1
                                      • Size 264KB
                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      data_2
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2
                                      • Size 8KB
                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      data_3
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3
                                      • Size 8KB
                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                      • Size 4KB
                                      • SHA256 d8d8b66f3f60352bd1e778469ed178a91bbd00e4f1ceffeec364b0ce8fc44fcd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                      • Size 3KB
                                      • SHA256 86d065a01d516ca8e1f43a3ce030e53451bc6396851ff963edcdf26af3ffcf54
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      memory/1416-621-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/1416-688-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/1416-1453-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/1416-1450-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/1416-1764-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/1416-14-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/1416-2747-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/1416-622-0x0000000000B50000-0x0000000001151000-memory.dmp
                                      Download

                                      memory/4284-1825-0x00007FFAA0640000-0x00007FFAA0641000-memory.dmp
                                      Download

                                      memory/4284-1824-0x00007FFA9F110000-0x00007FFA9F111000-memory.dmp
                                      Download

                                      memory/4328-2727-0x0000000000E50000-0x0000000001447000-memory.dmp
                                      Download

                                      memory/4328-608-0x0000000000E50000-0x0000000001447000-memory.dmp
                                      Download

                                      memory/4328-2920-0x0000000000E50000-0x0000000001447000-memory.dmp
                                      Download

                                      memory/4328-689-0x0000000000E50000-0x0000000001447000-memory.dmp
                                      Download