20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

user interaction
yes
max time kernel
1800s
max time network
1756s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260815-exldaayeqe
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
47	3044	installer.exe
14	6120	OperaInstaller.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
2128	OpInst.exe
3044	installer.exe
5488	installer.exe
776	installer.exe
940	installer.exe
4524	installer.exe
1452	Assistant_130.0.5847.41_Setup.exe_sfx.exe
5956	assistant_installer.exe
2564	assistant_installer.exe
5068	installer.exe
4588	installer.exe
200	opera.exe
3048	opera_crashreporter.exe
5644	opera.exe
4508	opera.exe
3344	opera.exe
4644	opera.exe
5808	opera.exe
4628	opera.exe
3892	opera.exe
1600	opera.exe
5688	opera.exe
5420	opera_crashreporter.exe
944	opera.exe
1836	opera.exe
1764	opera.exe
3052	opera_crashreporter.exe
4736	opera.exe
2996	opera.exe
5388	opera.exe
4476	opera.exe
5020	opera_crashreporter.exe
3116	opera.exe
4112	opera.exe
5784	opera.exe
3404	opera.exe
6096	opera.exe
3624	opera.exe
3776	opera.exe
464	opera.exe
2368	opera.exe
2692	opera.exe
2120	opera.exe
5128	opera_gx_splash.exe
2032	opera.exe
3040	opera.exe
5924	opera.exe
1236	opera.exe
2632	opera.exe
2316	opera.exe
468	opera.exe
3160	opera.exe
3708	opera.exe
1356	opera.exe
900	opera.exe
2536	opera.exe
2176	opera.exe
4980	opera.exe
4972	opera.exe
3108	opera.exe
4336	opera.exe
4236	opera.exe
3432	opera.exe
716	opera.exe

Loads dropped DLL 64 IoCs

pid	Process
5956	assistant_installer.exe
5956	assistant_installer.exe
2564	assistant_installer.exe
2564	assistant_installer.exe
200	opera.exe
200	opera.exe
5644	opera.exe
5644	opera.exe
4508	opera.exe
4508	opera.exe
3344	opera.exe
3344	opera.exe
4644	opera.exe
4644	opera.exe
5808	opera.exe
5808	opera.exe
4628	opera.exe
4628	opera.exe
4508	opera.exe
3892	opera.exe
3892	opera.exe
4508	opera.exe
1600	opera.exe
1600	opera.exe
4508	opera.exe
4508	opera.exe
5688	opera.exe
5688	opera.exe
4508	opera.exe
944	opera.exe
944	opera.exe
1836	opera.exe
1836	opera.exe
1764	opera.exe
1764	opera.exe
4736	opera.exe
4736	opera.exe
2996	opera.exe
2996	opera.exe
5388	opera.exe
5388	opera.exe
2996	opera.exe
2996	opera.exe
2996	opera.exe
2996	opera.exe
2996	opera.exe
4476	opera.exe
4476	opera.exe
3116	opera.exe
3116	opera.exe
4112	opera.exe
4112	opera.exe
3116	opera.exe
3116	opera.exe
3116	opera.exe
5784	opera.exe
5784	opera.exe
3624	opera.exe
3624	opera.exe
464	opera.exe
464	opera.exe
2368	opera.exe
2692	opera.exe
2368	opera.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\scoped_dir1764_1839157266\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-und-ethi.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-sq.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-or.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-nl.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-eu.hyb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir4476_27558803\opera-one-dark.jpg	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-sv.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-nb.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-la.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_414207759\mtc_config.pb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_414207759\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1697053939\Google.Widevine.CDM.dll	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-de-1901.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_BITS_4476_1011236232\decoded_xz	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-te.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-hr.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-be.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1639123526\_metadata\verified_contents.json	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir200_1608656015\opera-one-dark.jpg	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1442557570\heuristic_regexes.binarypb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-tk.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-de-1996.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_414207759\ct_config.pb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-nn.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-hy.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-gl.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-de-ch-1901.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1590556692\crl-set	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1725363032\_metadata\verified_contents.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_414207759\crs.pb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1697053939\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-lv.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-bg.hyb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir200_1787362963\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir4476_1109815960\persona.ini	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-ga.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-fr.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_414207759\kp_pinslist.pb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1087255224\LICENSE	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-uk.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-et.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-cu.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-bn.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-as.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-af.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-kn.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-hu.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-el.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-cs.hyb	opera.exe
File created	C:\Windows\SystemTemp\scoped_dir4476_1109815960\opera-one.jpg	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1442557570\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-ta.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-mr.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-it.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-gu.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-cy.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1639123526\preloaded_data.pb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1442557570\_metadata\verified_contents.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1087255224\manifest.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_1087255224\_metadata\verified_contents.json	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-sk.hyb	opera.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4476_560705580\hyph-pa.hyb	opera.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5644	opera.exe
4736	opera.exe
4112	opera.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe

Modifies registry class 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\DefaultIcon	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" -noautoupdate -- \"%1\""	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\ddeexec	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.opdownload\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.html	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.shtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xht	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\command	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xht\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell\open	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\ddeexec\Application	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.html\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.shtml	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\FriendlyTypeName = "Opera Web Document"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.opdownload	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xhtml	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xhtml\OpenWithProgIDs\OperaStable = "0"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\134.0.5954.56\\notification_helper.exe\""	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\URL Protocol	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\ddeexec\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\ddeexec\Topic	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\ddeexec\Topic\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.htm	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.htm\OpenWithProgIDs\OperaStable = "0"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.shtml\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xhtml\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.opdownload\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}	installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{54196CB9-E79D-423F-9D42-704EC9AF122E}	opera_gx_splash.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe,0"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\OperaStable\shell\open\ddeexec\Application\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.htm\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf\OpenWithProgIDs\OperaStable = "0"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xht\OpenWithProgIDs\OperaStable = "0"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" \"%1\""	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\134.0.5954.56\\notification_helper.exe"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.html\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Applications\opera.exe\shell\open\command	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32	installer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4476	opera.exe
4476	opera.exe
6568	opera.exe
6568	opera.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs

pid	Process
200	opera.exe
200	opera.exe
200	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe
4476	opera.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	200	opera.exe
Token: SeCreatePagefilePrivilege	200	opera.exe
Token: SeShutdownPrivilege	200	opera.exe
Token: SeCreatePagefilePrivilege	200	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	5128	opera_gx_splash.exe
Token: SeCreatePagefilePrivilege	5128	opera_gx_splash.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe
Token: SeShutdownPrivilege	4476	opera.exe
Token: SeCreatePagefilePrivilege	4476	opera.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 2128	6120	OperaInstaller.exe	90
PID 2128 wrote to memory of 3044	2128	OpInst.exe	91
PID 3044 wrote to memory of 5488	3044	installer.exe	92
PID 3044 wrote to memory of 776	3044	installer.exe	93
PID 3044 wrote to memory of 940	3044	installer.exe	95
PID 940 wrote to memory of 4524	940	installer.exe	96
PID 3044 wrote to memory of 1452	3044	installer.exe	102
PID 3044 wrote to memory of 5956	3044	installer.exe	103
PID 5956 wrote to memory of 2564	5956	assistant_installer.exe	104
PID 940 wrote to memory of 5068	940	installer.exe	105
PID 5068 wrote to memory of 4588	5068	installer.exe	106
PID 5068 wrote to memory of 200	5068	installer.exe	107
PID 200 wrote to memory of 3048	200	opera.exe	110
PID 200 wrote to memory of 4508	200	opera.exe	111
PID 200 wrote to memory of 5644	200	opera.exe	112
PID 200 wrote to memory of 3344	200	opera.exe	113
PID 200 wrote to memory of 4644	200	opera.exe	114
PID 200 wrote to memory of 5808	200	opera.exe	115
PID 200 wrote to memory of 4628	200	opera.exe	116
PID 200 wrote to memory of 944	200	opera.exe	117
PID 200 wrote to memory of 3892	200	opera.exe	118
PID 200 wrote to memory of 1600	200	opera.exe	120
PID 5688 wrote to memory of 5420	5688	opera.exe	122
PID 200 wrote to memory of 1836	200	opera.exe	123
PID 5068 wrote to memory of 1764	5068	installer.exe	124
PID 1764 wrote to memory of 3052	1764	opera.exe	125
PID 1764 wrote to memory of 2996	1764	opera.exe	127
PID 1764 wrote to memory of 4736	1764	opera.exe	126
PID 1764 wrote to memory of 5388	1764	opera.exe	128
PID 5068 wrote to memory of 4476	5068	installer.exe	129
PID 4476 wrote to memory of 5020	4476	opera.exe	130
PID 4476 wrote to memory of 3116	4476	opera.exe	131
PID 4476 wrote to memory of 4112	4476	opera.exe	132
PID 4476 wrote to memory of 5784	4476	opera.exe	133
PID 4476 wrote to memory of 3404	4476	opera.exe	134
PID 4476 wrote to memory of 6096	4476	opera.exe	135
PID 4476 wrote to memory of 3624	4476	opera.exe	136
PID 4476 wrote to memory of 3776	4476	opera.exe	137
PID 4476 wrote to memory of 464	4476	opera.exe	138
PID 4476 wrote to memory of 2368	4476	opera.exe	139
PID 4476 wrote to memory of 2692	4476	opera.exe	140
PID 4476 wrote to memory of 2120	4476	opera.exe	141
PID 4476 wrote to memory of 5128	4476	opera.exe	142
PID 4476 wrote to memory of 2032	4476	opera.exe	144
PID 4476 wrote to memory of 3040	4476	opera.exe	145
PID 4476 wrote to memory of 5924	4476	opera.exe	146
PID 4476 wrote to memory of 1236	4476	opera.exe	147
PID 4476 wrote to memory of 2632	4476	opera.exe	148
PID 4476 wrote to memory of 3304	4476	opera.exe	149
PID 4476 wrote to memory of 1788	4476	opera.exe	150
PID 4476 wrote to memory of 2316	4476	opera.exe	151
PID 4476 wrote to memory of 468	4476	opera.exe	152
PID 4476 wrote to memory of 3160	4476	opera.exe	153
PID 4476 wrote to memory of 3708	4476	opera.exe	154
PID 4476 wrote to memory of 1356	4476	opera.exe	155
PID 4476 wrote to memory of 900	4476	opera.exe	156
PID 4476 wrote to memory of 2536	4476	opera.exe	157
PID 4476 wrote to memory of 2176	4476	opera.exe	158
PID 4476 wrote to memory of 4972	4476	opera.exe	160
PID 4476 wrote to memory of 4980	4476	opera.exe	159
PID 4476 wrote to memory of 3108	4476	opera.exe	161
PID 4476 wrote to memory of 4336	4476	opera.exe	162
PID 4476 wrote to memory of 3432	4476	opera.exe	164
PID 4476 wrote to memory of 4236	4476	opera.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=NzBjYjg1NDU2OWYwZjNiMTNjMjkwODc0N2YwMDk0MTU2YjVmZmY1MmJjMTBkMjY5MGU1ZTk4NzcxNTY4ZDA3ZTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4Njc2NzYwOC4yNDczIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMTM0YTM0ODgtZGZhMC00YjFlLWFhZTgtZWQ5ZmVlMDhiNGI3In0=
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2b0,0x2b4,0x2b8,0x288,0x2bc,0x7ff63e2fad88,0x7ff63e2fad94,0x7ff63e2fada0
      4⤵
      Executes dropped EXE
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:776
  - - C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3044 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_20260815052011" --session-guid=5f5b7773-048f-4a9a-bbfc-2e5be3500631 --server-tracking-blob=OTExMTI3ZjdlYjE3YzYwYjJmOWY1ZTBmN2I3ZGU2MGE3ZjhhMjI3M2RkZTBlMGI2OTQ4OWJlMDI0N2I2NWEzODp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2NzY3NjA4LjI0NzMiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiIxMzRhMzQ4OC1kZmEwLTRiMWUtYWFlOC1lZDlmZWUwOGI0YjcifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B008000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2ac,0x2bc,0x2c0,0x288,0x2c4,0x7ff63e2fad88,0x7ff63e2fad94,0x7ff63e2fada0
        5⤵
        Executes dropped EXE
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\installer.exe" --backend --initial-pid=3044 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111" --session-guid=5f5b7773-048f-4a9a-bbfc-2e5be3500631 --server-tracking-blob=OTExMTI3ZjdlYjE3YzYwYjJmOWY1ZTBmN2I3ZGU2MGE3ZjhhMjI3M2RkZTBlMGI2OTQ4OWJlMDI0N2I2NWEzODp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2NzY3NjA4LjI0NzMiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiIxMzRhMzQ4OC1kZmEwLTRiMWUtYWFlOC1lZDlmZWUwOGI0YjcifQ== --silent --desktopshortcut=1 --install-subfolder=134.0.5954.56
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff68d58ad88,0x7ff68d58ad94,0x7ff68d58ada0
        6⤵
        Executes dropped EXE
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\de932af914ba00303d4a2778a383ac9c831101e2.crx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ffa2fe6e310,0x7ffa2fe6e320,0x7ffa2fe6e330
        7⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1772,i,3979169552688610375,4996606440157137862,262144 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2072 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1988,i,16001368207885176437,3979839673073837011,524288 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2116 /prefetch:11
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        Enumerates system info in registry
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2528,i,13489467726917142724,5555866295045575467,524288 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2708 /prefetch:13
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3436,i,15591250128074528715,3970333575799330028,2097152 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3492 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=2756,i,314851608216746733,10895569835945579752,2097152 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3424 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4412,i,5166411480837127105,4498522491664508877,524288 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4424 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4496,i,18312046426668531834,16931591049020408743,2097152 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4628 /prefetch:9
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4880,i,1414145738461067152,11918032315558775184,524288 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4872 /prefetch:12
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5096,i,9254741089074076692,13233059178887706508,524288 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4856 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4524,i,2608984319176395670,17127367084143884450,524288 --field-trial-handle=2080,i,8944440518222700817,18193512941011200251,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2084,i,5254821940198345993,16706491805559051015,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5112 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\additional_file2.tmp"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x294,0x298,0x29c,0x290,0x2a0,0x7ffa2fe6e310,0x7ffa2fe6e320,0x7ffa2fe6e330
        7⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1940,i,13959041782373083666,11080802505672763432,524288 --field-trial-handle=2052,i,10739998864526456202,14142518034737431600,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2056,i,4887370185091943957,1279595831284047582,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2100 /prefetch:11
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1720,i,3492811884121727596,15707349276577546733,262144 --field-trial-handle=2052,i,10739998864526456202,14142518034737431600,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2056,i,4887370185091943957,1279595831284047582,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2040 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2524,i,6911193438850588409,10264236622212323127,524288 --field-trial-handle=2052,i,10739998864526456202,14142518034737431600,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2056,i,4887370185091943957,1279595831284047582,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2392 /prefetch:13
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x294,0x298,0x29c,0x290,0x2a0,0x7ffa2fe6e310,0x7ffa2fe6e320,0x7ffa2fe6e330
        7⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1696,i,13389477820002573580,829768532328510446,262144 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1972 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2008,i,10680300852185461792,16493917412686944872,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2060 /prefetch:11
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2488,i,11279090042533462221,3194540205537456201,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2512 /prefetch:13
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3168,i,982628308238812629,7718560486222019957,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3236 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3184,i,15289146122056644967,7810957888843391158,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3280 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3256,i,4532304744769184561,4166282703192937309,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3300 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3268,i,14401455732202669391,11610543845601618326,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3320 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3340,i,14630554395782724847,4798040940154072855,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3740 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3364,i,2573940612544317357,5590312550319512474,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3756 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3372,i,17551963047614322560,15456187637514961476,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3776 /prefetch:14
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4100,i,14746527810478209646,8859453927924248508,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4104 /prefetch:1
        7⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_gx_splash.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C96
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4724,i,9423297310315850126,14964816736036248561,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4720 /prefetch:9
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4880,i,8787826758238483920,2775088532214478913,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4896 /prefetch:1
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5176,i,5404292866314327054,17848516512438120834,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5188 /prefetch:1
        7⤵
        Executes dropped EXE
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5328,i,16575796307450940306,16825371844090535515,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5312 /prefetch:1
        7⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6324,i,8550905348354378062,7721341623569627856,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6340 /prefetch:9
        7⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6820,i,1144683261569520901,18317640217460610183,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6880 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6908,i,3888202066242014939,5102393957930370887,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6968 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6616,i,2538109842375217623,2320680997754587931,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5564 /prefetch:12
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6528,i,4994466058155432836,8542171126227834737,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7312 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7284,i,2896007418717734686,11670062120333266530,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7332 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5920,i,16517325622410371386,5163668451040460420,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7352 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5168,i,5389791988798272565,11445883876238766722,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7372 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7300,i,7230304729176899239,16655005877714735579,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7412 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7292,i,12905695416222847212,5458211335491561396,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7392 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8156,i,12252540711611246321,2538321693538651743,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8164 /prefetch:9
        7⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8224,i,10524978590353762471,10252613044732054216,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8352 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8332,i,7028060672479934218,17179309112532503027,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8372 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8340,i,3051233996344472344,9478598773836037556,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8392 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8612,i,15751195983950735359,1588042190097464272,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8744 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8796,i,7200086689482640210,2941982010572699814,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8888 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8896,i,8853603317386058004,5914940127927422980,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8940 /prefetch:14
        7⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8804,i,5302569738771564436,8548411923583091285,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8916 /prefetch:14
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9284,i,16070817374709030540,7422776576536502866,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9292 /prefetch:14
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9432,i,4676374841899241217,12046748529445057315,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9460 /prefetch:14
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x25c,0x260,0x264,0x23c,0x268,0x7ff7cf0538c0,0x7ff7cf0538cc,0x7ff7cf0538d8
        8⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9604,i,11996117307134167045,9507692005528065537,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=8188 /prefetch:14
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=9824,i,1719879812855052078,2691147668284784113,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9868 /prefetch:1
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10412,i,5598254158077326353,8171415260493002706,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10424 /prefetch:14
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=9080,i,1362316470232074009,18336803928255098071,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=9052 /prefetch:1
        7⤵
        Enumerates system info in registry
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10556,i,956976056403221623,11550983775021288192,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10652 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7536,i,16605650998973810374,967005096211958600,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10668 /prefetch:14
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4104,i,2422380348540786469,1205717456404164102,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=1864 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4564,i,15736465850770956654,6205358251611434954,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=4128 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7988,i,13761898567416606050,8215428271693431006,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=3836 /prefetch:14
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=4568,i,17983593473694791591,10933695426044840326,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=4512 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8224,i,2183440100499215280,6722088658043365295,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=9368 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3852,i,7991343936057605843,1622571005469076017,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=4072 /prefetch:14
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=4104,i,10501475799678873115,54493387886139685,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=5584 /prefetch:9
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6860,i,15761495434768159529,14844301654846953822,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=8116 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6848,i,4677660730274788369,2186460833112519337,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=8224 /prefetch:14
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8084,i,16856198900630914438,11605342631195801083,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=6840 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=3336,i,16125718977075423622,4597496166403929954,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=8224 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=1832,i,15011611720464389035,6851684285313400143,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=6380 /prefetch:9
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3336,i,7699910764379834402,15567312067508697609,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=6996 /prefetch:14
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6832,i,18343884914905362987,13832941399921811202,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=1832 /prefetch:14
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=8628,i,5011326775595029444,11609258626355096762,262144 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=1284 /prefetch:10
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7040,i,9867294190697892504,11812498761250690433,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=7084 /prefetch:9
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9308,i,3994817404345232374,15382580961759828843,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=8120 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7132,i,14774106810743886664,5939398046374693215,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=912 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=3312,i,380036058948827385,8748290696979194043,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=3268 /prefetch:9
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6868,i,10973433426281917232,129685742245811008,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=9296 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3736,i,7400988360861426533,17573932543462980232,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=4556 /prefetch:14
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7772,i,18189123861187959834,321215978027900,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=1840 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6260,i,2526075420554525785,7465437323904014621,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=8808 /prefetch:14
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4104,i,10633208870503458205,17103587190866826664,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=6420 /prefetch:14
        7⤵
        Enumerates system info in registry
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=3364,i,8498712001942206206,11136677966852339245,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=5604 /prefetch:9
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7344,i,7838745829712281009,18411365877003183837,524288 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=5460 /prefetch:14
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=5560,i,8169539584117273540,10777791944699681301,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709052841842773 --mojo-platform-channel-handle=6912 /prefetch:9
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=9368,i,13653726282404038813,5656598265523463350,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709053778884622 --mojo-platform-channel-handle=3680 /prefetch:9
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=3664,i,14199446708047236793,4111202202164871361,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709054715926471 --mojo-platform-channel-handle=3828 /prefetch:9
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=3828,i,6542913654514997302,2550744370439131055,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709055652968320 --mojo-platform-channel-handle=9408 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --version
        7⤵
        Enumerates system info in registry
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffa2fe6e310,0x7ffa2fe6e320,0x7ffa2fe6e330
        8⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff7cf0538c0,0x7ff7cf0538cc,0x7ff7cf0538d8
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=3832,i,11805162381503125812,7469989518344514680,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709056590010169 --mojo-platform-channel-handle=7772 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=3272,i,17061957006707242529,12433152736213722237,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709057527052018 --mojo-platform-channel-handle=3668 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=9368,i,16196759575930031840,17055632289544564546,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709058464093867 --mojo-platform-channel-handle=3468 /prefetch:9
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=3816,i,9032152364018319119,14898285909252959108,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709059401135716 --mojo-platform-channel-handle=5500 /prefetch:9
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=6824,i,9355964918585514953,11614446783854939551,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709060338177565 --mojo-platform-channel-handle=3728 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=6428,i,3000254956618291880,16799515731620418545,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709061275219414 --mojo-platform-channel-handle=10656 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=4040,i,12488775685538553989,8205950762171595335,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709062212261263 --mojo-platform-channel-handle=3944 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=3968,i,2522636605229592081,5392836312171598603,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709063149303112 --mojo-platform-channel-handle=3880 /prefetch:9
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=3996,i,11855940590794962327,16077595856141463115,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709064086344961 --mojo-platform-channel-handle=7392 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=3588,i,17098544664186478418,13894622827970025184,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709065023386810 --mojo-platform-channel-handle=3616 /prefetch:9
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=3616,i,13675977462774186169,13324124285760373766,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709065960428659 --mojo-platform-channel-handle=7568 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=3616,i,13138437784683922550,13774223320761158211,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709066897470508 --mojo-platform-channel-handle=4028 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=7476,i,17827869203248017618,9432596935749892308,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709067834512357 --mojo-platform-channel-handle=3484 /prefetch:9
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=8488,i,11987313092203884268,15205142350111252801,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709068771554206 --mojo-platform-channel-handle=8376 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=8508,i,6708504617552502669,1625340184750260313,2097152 --field-trial-handle=1976,i,3012382303199210585,7699807676579102507,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=ExternalDecoderInAudioFileReader,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,13793949761372807329,9187540909880776195,4 --trace-process-track-uuid=3190709069708596055 --mojo-platform-channel-handle=8604 /prefetch:9
        7⤵
        Enumerates system info in registry
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x6c4040,0x6c404c,0x6c4058
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5464

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 0
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:252

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe
  C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ffa2fe6e310,0x7ffa2fe6e320,0x7ffa2fe6e330
  2⤵
  - Executes dropped EXE
  PID:5420

C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC1
1⤵
PID:6428
- C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
  C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff7cf0538c0,0x7ff7cf0538cc,0x7ff7cf0538d8
  2⤵
  PID:7508
- C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
  2⤵
  PID:8104

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:7268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 ca178ade85272cbf7d3f8c9e1efcd216eadbab55d8b9802aacbfe3e9c009dfdb
MD5 2b5ae3784bf09795429ca8b204eae3ca
SHA1 b4296ec18dfbc5e553a89fed17ec2bc390f766f8
SHA512 151a1371d00126a35b2a324b25d305736bd0e6bf37e3794b9f5fcc9cc5f49a6fdeaa93dbbfa43d95087c5a66dfeb4cec2b12081b933379ad1d6d614a4f53fe5e
TLSH
T1CCF0D4C6209CB5915A14CFCD24E55F273870957C04D80595D62844FC45B07BC3F5B032
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 6f6c898a237840856bebcaa661800c92330af52bbccc063f883cbdcfdef598f1
MD5 94806aaf151d14c761d36bb58b3a4bd5
SHA1 5349a5c18d080a255f996518e1e79eaceac8f625
SHA512 64730b5357f1311fdd410053d2a0a00003aab81916ebf48766fad340b502bc99aff993552d781d929c39d1dc6923f7e6aa53c63ed4c3e59e4aa232cd3fb01414
TLSH
T1FFC09B4837B54266F1304DBF1667531387FAE505DD4183550F705259C52DF425CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 6a86b82a34a096b34b7523ab8df3cf8adc9a405a97034d754283d10eb49b03eb
MD5 128a9e25de007a16998efb98f0658b91
SHA1 bde7071e9e395a95c9d9930d8ef6d2721d85fe05
SHA512 34621742cfd6bcbdc5e64184fb4697a983dc224b31ec551f632fd5c48dd836e4622c60f3acd4e69cfadbf43acf11c110aa41b76f2bb2e2531faed78b05c28957
TLSH
T18CC09214B3A9471AF11E613E7DEA1A041BFA820AF6DAC3044BB821388A28A400CB2D49
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 9661f72473e5387d3b5094247a06a9ec51c0b06cf90ad51678796abe2172a0e7
MD5 2fdb457778d355b209a73509a31ff48d
SHA1 c231fb06b6716b9342657403d4f80a27c072776f
SHA512 69d95e69f85e87b68c3f213cc83263ecba19101cc7a22fa9cbfd7f6d5d1a8afcd6bad7a697a299d391ee272afd715f8a55ee5d6c9ebb43242ea87a215fc09075
TLSH
T160E0C0241AFB40FDF4F8D4784FD9B6310E56F0265419A3B00EE44B047702D00EE22B75
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_0
Size 44KB
SHA256 c6c79d5b32344559ad3a6fbc184eb8ec094c2a111629ebd43ad32aec868e687c
MD5 144b96f6584af5d31a69ffe7ddfd6d7f
SHA1 aa75a399bf7cc28849163a74341772a8d1655936
SHA512 4d00a5d238d3b60add78c6dfffce30857166cd3dce22144584e45f2aba01bd662b64a705364698fdc5f4bd99b1e5f5cc865923cc36364099febc9117a88a0ce0
SSDEEP 3:MsFlTlrllkl2XtSyega9ikNSlkgyega9wD:/F02XPq9ikokPq9wD
TLSH
T1421312ADD5701943C5100C385741C2703E30D1C802290F0300103F1C1C103C3EB1C0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

134.0.5954.56.manifest

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\134.0.5954.56.manifest
Size 225B
SHA256 f1841e5ab59918b79032d1e1456aa5d030eb5d65853f4584d1105ce2080d78c2
MD5 6cce8f005d1829fe59246310820edc15
SHA1 caa79fcb4275705bdcc46776f065d67d2320b0ab
SHA512 6134e22c2c11379eef4d0baf30a7a3b9a5e05facd0e81fc1de375bcdb287f731158d4758bf94e25e907d9cbfe80a94d634e0e849d595415666c0bcaccb84a410
TLSH
T14AD0A901888A22096B6341A03CAAA8016118C76708CCA04870FCF867BFA3928A2928B0
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-100.png
Size 1KB
SHA256 56bcd46dcfae3147a8b8b3d00ee5041dad4655e83a7e829bf637377c96538643
MD5 f4d70bc86e8544d7758742c2eba89d47
SHA1 5df4635794ab25e2f88bcf8ec39c19a09383a029
SHA512 d20cbd543bf97890d64c07f9e99188604f4dc5def904ad74229a3b1d9d9a06fff93af711c99a178799e9de472d930aa52a0c154f0d2953abe5ffc3cfd1708ab9
TLSH
T11811C840D668A4ECCCCD5DBAB2BC3893D7529C198049B1DB4CE1E8E38C303050976E0E
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-100_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-100_contrast-white.png
Size 1KB
SHA256 3829dbefe8bd528be268f3181a902e1fe78883eb8f8aac679c9985c2ad13c6b9
MD5 7f69f89f11fd675b36e8de01de3c29ad
SHA1 b91e00e68889367de138ffa5e7fb3c9de2a18467
SHA512 06c162296c5ac62429e6e5dec07b836e6053cb4eb0291d8ed904f71cc42352c134870ed964517d2600f03fd7cf3821ee877ea83a330c9597fd7d629f9c2a6432
TLSH
T1081184F6422D2D1DF58532B16EE55FE299A82B2535D0BA425008C1194E2B512C900180
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-140.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-140.png
Size 1KB
SHA256 2637072751e1e6398c45d2c5b22c54adadfbbd4d3007238799f5da63f846167b
MD5 a0076d9b3db9054267a7c86c9323aea1
SHA1 22b85aeec3e3804fe1f6e91d5a9ac1c6a0153b6c
SHA512 8fb750bddea61501f8ce2b0d0c27d29f322c9f297777f26b1401696c836c844369a9f6890bbb9827682deb70004cd98a973a0742d2d218f12a9fc3c301f10985
TLSH
T10121F84FCC2CE4E4CEDD49323C15A326A33021C950036F8A99CAD3F2876474C68B71D8
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-140_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-140_contrast-white.png
Size 1KB
SHA256 ce3559b2efd6d547fb822440690cfbf793eb70c98154ad4dbf3a7c0e1af5e166
MD5 f601df01a867a51514ea89ac9bfe9b86
SHA1 827cf9859b7b1864236cd1f03e8aa40758285e82
SHA512 2714e67298058e8fdad4459cfa17e2c7c67353bbfd9ea850bb403e669ae085ba579c31f7d64889470a97565719342e6a30efe2f66566783197194433aa947600
TLSH
T1DE21B45BA702048EC2065E3F4D54C81B6591FFAAA3B3DD4B265303B0A44217E18E76B4
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-180.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-180.png
Size 1KB
SHA256 7ca510381079a4b166e9d5fcf0dc005d9606197e8636621b655d6459941139a0
MD5 0a76f51f6169a31402ff7c61cfd05161
SHA1 843a32d6dc0d5b9d97c5f475f96e49852823a103
SHA512 7056949d7aa9cc4c96f9c13d656cfffa9f9a49ca78f6be3037cd38cc1d8712917cc235099f24723bba26fc9ffdba015480309d0418961c1116dbe7b65de6301f
TLSH
T14A31D8C629E310F9F9FC01F501126A6CD7C095D41162215B68CADDB42CB37257BB90A5
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-180_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-180_contrast-white.png
Size 1KB
SHA256 f7eb888cd9bce4641fcb01088b05be242f616dc06c3f823e51fb63b53b6f14f5
MD5 67a0163cd9753e42360222a17173f593
SHA1 e4ee5c2288cbd5d354aad1905b917285a3daeb92
SHA512 87e69e15ba6dee402dbe5a90da864136ec2c6884c204a567ad461e0181e70514f73a7df22a47de63d4829fa937e56fc4c08cb6c5268313f7b9af1e7217d81f47
TLSH
T10F313C6F5D568577E37C42BCBA7085F5D325B31C400727106F34B2983814E5521A89CD
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-80.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-80.png
Size 827B
SHA256 f287370ff8c7e2ba120407cafe09c1fce674ae8af5bd5fcc0c2dd1c6628b9ce9
MD5 95a8f1834d8da00ad94c0cf2aa09853c
SHA1 7e830e3ef55b4d7b9a18ec8c151bebb2c28f0069
SHA512 c89be6e503c26efd4eec12c77e091570e187ff64928cab01f6f873d9ca3769f019a1724f76b57c9d4038495e29cc4106f919082913323af1ece7aff820c828f1
TLSH
T16C0120FB28489DD0CEE79271529CC55D9BC259065A80D0F7D2E9D8C05D33B49E678810
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-80_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\150x150Logo.scale-80_contrast-white.png
Size 799B
SHA256 0a9129bde051c17e96e516d5bc509e1a06a1e066a5e2796627cbef8630002b47
MD5 3015766c5ca769e54009f167550f7389
SHA1 0eff02455a1e0fa1724bb1d4333c3d24329f9e9a
SHA512 7ea7495163e0246f78f88dfd0ee72b8584108c286227d70cec9de125747f21f2618f46f7197f7cb9c0f40d297bcc3582cf70f54ebf7f9eb10941fbaa6bf0149b
TLSH
T17B010AC8D032EEA5D91788F36CA24FD59CEF42F000181B2C84A880913C030D6B03ECA5
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-100.png
Size 781B
SHA256 fb5662c5fde7d49862da2e0253ae03dc7e5f9afd2edc65d4efa6dc3a3026156f
MD5 ef710f4543a25076078fbc1c09ec9e2c
SHA1 e4ea1c2cb24cfff03569dab28877d11f9c6cfc74
SHA512 fc979d06806a69da71336533d96b1cb66b227064a224e23c6f5bf9d1fe4e85a9d9546643ce296ba5f04c025284d5ca2c445c52695aae669735a2a5b48ce07a00
TLSH
T122016002E621E8FADFDE023E322C446D4725035AA706BA1F00C6F8A72EF0B4820B7049
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-100_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-100_contrast-white.png
Size 752B
SHA256 3fa9dfc982544f3ffda0795beec69c65d6c5883be0de37133466e643b5f3aeea
MD5 ae8eecb8db4d20efbd816b887ef75840
SHA1 1d0cc741d0a75e5e8ab51dd8b6a99f5e679ef5db
SHA512 0cb71eb86ab2c5d4c70f04d7b10736aa453d51b56723ed7c9dc332f92ea428eb7861f23da2e30416bea8cc59877ba2c87f3032ea473028a7df8c6a299d517572
TLSH
T13501B5E19CA5D03C9D59ACB03820317AFFBF65062CA02F825474762B2010CB538E50CF
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-140.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-140.png
Size 991B
SHA256 84f8ebb629791e0b73cd53d7f3445d685145d0787a207e25842b237c98a8c99a
MD5 9590b4bd9378a2d8706dcbdc630fae8a
SHA1 751eb2aa5ce4e83133a73fdb9efffc013bf37ec8
SHA512 b2666efa916584c9b090e305eda116f2a90c58862fa36a0963176b09b493a4ce5e601a178c74be0f2e59811ad42cd1d5747e8a45ea07c3f5d52b28e177fa5603
TLSH
T13C118820BE023DEDEAD89D14E139505E86042902332860CBA0E5D4908EBE79044F095D
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-140_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-140_contrast-white.png
Size 865B
SHA256 99cd2b5809ab9c604613b305bc80e6f68b858c1289c07e84aadabc4c3768ff32
MD5 9b103e9dfc26dd4d837df8ab55ec4fb8
SHA1 6f46830a3a63e0eec923bccfad57d8391ac3e559
SHA512 e8023067638a9fb849ac9364a45c8be9a6dd325fbc704d960cf270ce1075ac6c9d57b7f96cae62985e92e5543dc2f2a43d473a2dcb0060af067cd474aab7e59a
TLSH
T103118AFB1644C6ED594F572F50DA9C51734B8A3B836E80189A3C869CD190F44CB77ED1
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-180.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-180.png
Size 1KB
SHA256 c5d33ee3b5e8dcb9e9aeae5f14d0e92cf9bdc16d6245ce65dd4340c8a0be4f26
MD5 7ab03a8ba1c0243b96c4124cd5341073
SHA1 7de490dd37ebed58337fc0db654f12398e84a78a
SHA512 c96846f008e8ab440009bf2442a2cb9db3d24452619c8c2b669395f971f9a316ec62693bb586a94e565f1cab893bf665112c34cc1fa46319e571e3fb4d2fc41d
TLSH
T18021E7612B26DDFBD7C182F1913B4A395E1CD582327461369CC2E1623C3772E1271248
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-180_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-180_contrast-white.png
Size 1KB
SHA256 e5112331e0e2684ffb5adc0ac23324d9836cf067111f1f5834c77b1153a8a5d7
MD5 1521be4b8c8f2e0ce20a89f163de3909
SHA1 c291448b74fc3d7060c1df4b35026084981ee441
SHA512 6a0781d275dbf8fad4ee464e759de74399918abdc99cef3c74e5d66a0d555a8bed363da964c15e2ad9ab3cde5a17d537bbcbadb10585aa1ef50f0b614fc39a50
TLSH
T1E011BB5771622D70C791577F5868F505DC72D33134A18DCB5CDF29ABD0C62B4449C242
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-80.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-80.png
Size 590B
SHA256 91ba72309e34c5336c09b8f5c787a6327082f275d5d7bfe491c5430e67c80752
MD5 1b4ff26a106929e3a5710900a9d984e7
SHA1 d3e1bb4fa64083743ab56ecd89d586df6b583bce
SHA512 d8537fa3b0da1b2ee7c8cfbe9101a7dca624af4532305e06f211e4dac799ae9b533f19d3cdf052352e2a926bfe32cc908cd3944b2543010e7baefe52697add92
TLSH
T11EF0E16019445CD54FED19969A3D4F30EE5034155813BCA70DC2D8369E2634598B260D
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-80_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\Assets\70x70Logo.scale-80_contrast-white.png
Size 519B
SHA256 37b0f1fb4a08af8a42e6d8fce4c7380ddae0272150d7a9bb8b1d138066a9ffbe
MD5 169dc90309162bbabf07ac3d954a076f
SHA1 a4c87f029a4f34d66847271cdf8c5e73b1e48a90
SHA512 b7633c8faa5614efb402c47957577dbacca1a1b3fd0bb39cf79eb3a06ec6a55f9b8c5ee9569271efbfd7d43ad348d275c0c6c9faf840663268bca2fbc6c64bb7
TLSH
T1D9F075C360D1ED222EBA2004E411ECFC747A11985B439885003B48BF7F77F20A90B088
MD5 SHA1 SHA512 TLSH

Submit Download

assistant_package

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\assistant_package
Size 3.6MB
SHA256 edde79cc199536d4bb4a61c435f86e6d3c6c93663b4a3db2cf3f59c93e510173
MD5 a60d71f7a2f9100d9f649576b93fc00e
SHA1 f1318346188813ac7d52d11a5ab6a3daa647665e
SHA512 b7f2a387c9d5637ea0636e1f4f1bb1fd16e751f7919e473051e19e08d802f0feb11fedbd315d621ce51800e70616a9ca1ac79b22410e69e3d353f1f2208f7acc
SSDEEP 98304:ZkioX4lqW6yVelb4l3A6r590P39mGARehf+u/F:ZhlD6ZW3b61AeF1/F
TLSH
T1AC063332F6C4C432DA5727334CD4B6E8A57CB2623B564BAB37880B4F9FB01925612797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\d3dcompiler_47.dll
Size 4.5MB
SHA256 7d356c9f90dcf43151cb37ab361da40309c80cc5b20c397375b09e95d0fbeb95
MD5 525068e11f294a0fd8a48baccabd1c19
SHA1 989fd343f0b5efe6a2ca9d09de3ead47657bff88
SHA512 72f5512d5ca8c60cc0ec078bc29b11612da9fe14c65ae7e8a79ea5293b38594273a887a4e7b3c4a073e0d861d1d39d65f0038ba2fad8d25136f374c03dd9f142
SSDEEP 49152:86ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/n:8Udeqt737jFm5wP
TLSH
T191268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\dxcompiler.dll
Size 24.5MB
SHA256 09ea4b127b9a1b3033dc5ce936cefe80984c83fb3ce3abd5386934f324ca471c
MD5 67cfc2d8ad3054d6135ab3cf97436d4d
SHA1 0138fada43c01c4adae5258b3727171e2e603c29
SHA512 084132ca60f1ab44c2f5494b495ce7ceb3ba61419ce58aea89821f479881a7f1561d9b5cf30b45eec435413698b88a311a3ac38f973ca8a6574b8165de253529
SSDEEP 196608:Ea92SjdOKOEoV1TaUqcjdg6WRRiNrP/7m6Ilg8DDVrhQ/a/:PMSjgKOEnU/jdgfRRiNz7bIg8vlhQ/a/
TLSH
T1104739122646D49DC059C879C7678B26CA6C30E73FA7B9EFC0F451252B79EAC1B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\dxil.dll
Size 1.5MB
SHA256 fcc9b89660d63032ee93e7afca98d7b9d081e1b09edb8cf930335a0e2f31bbd2
MD5 4a25fbc698c63aa45be88d48fbee60cb
SHA1 13726ed13487553036cffbacdadb16241d0d1176
SHA512 708c187aaae16eb35b33ff971fa020735072fe822c7014a4b524193b9724aaaf20699ba0381951ea5c54751185eeb50c247be71697b4638c9067d2e6b3199257
SSDEEP 24576:PcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/z:PsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bK
TLSH
T1A9657D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\files_list
Size 6KB
SHA256 bbe5c7131308bf1cb8530b3c7a5489e7c1fa02c5041be66f9fac621ac6bcad04
MD5 c06bd66d6b8c83142cb2e2f798de4e71
SHA1 10a373d478319b722e742b92af22d4beee47ce1d
SHA512 3bcc5df6b94fdbd6b70387fae9ccea1efd30eafaf2057499642a1632e8635f2c089a9d1186d9445f429a19b8faf973e359d40f817903184c22b3a69f13d8ae15
SSDEEP 96:OMyTfz5XZyITJhGwbx7Vt/JnZ7vMbngEDi1JZJiRORnOU:fafz5XMRwbxHBZ7unmvgORnOU
TLSH
T18ED10697895F0265CAFD93F1EE61E89091342495EEB83058F7C70A5694A33FE02C9ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

headless_command_resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\headless_command_resources.pak
Size 2KB
SHA256 8c0af48079123a1ed6f03f0d830527b21cd224c2fc7575ec485c486da41b16c9
MD5 9c33095519168e92728c86a591a17862
SHA1 beec5c5d149d46234897395f72f95788a568537c
SHA512 f4323121659cdbbd1ac0872cde925dc6143ec2a3221c8ccbb2273e0916f1341beede54121e077b363e2995a656d46192758b65880b8dbf92cbac381a4431cde8
TLSH
T146511893360AB6A6C079C72C91DA9A7C6BE58325748DB5744EB70C33E9384A345C2871
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\icudtl.dat
Size 10.4MB
SHA256 d0a05dcc74a5b6ce1657a2ae44a58c0df03a1a07c24a4df2e3381353911382fc
MD5 f50c621247b8ddd574dc9790830f28c4
SHA1 ea84f3a773b5b90851753353826fcdf94576b3c1
SHA512 030df4e2c8f0354a97ac6a21774d6bab1246237bb71cc286b1a310b1a7602dc31fa056b8beb1157ac71b13d3744cba0fa71ac807e5f69fcafebb3cd827b553df
SSDEEP 98304:nHcBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndL+j89o:nHcBhORok2HiXUxO/RJk3IWhlYntjd/o
TLSH
T1F8B62803A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\installer.exe
Size 8.3MB
SHA256 ba2091e72ba4d42619a6f8cec3aab9764915f117cb16c6c70bf162ef636d95e5
MD5 234856a8d2ea36c4f6c03bcc4bba5393
SHA1 4314faa87e29e748e0c99fc726a56bb09d4fcae9
SHA512 9bc3640d15f36b0baee51291ea72bb5d2b11c35ceb79fb8cfddf0869ee0d475250cc953ae0f413bf693bab73cd7d516f156db2e25b282d9e1a0eaf155196d46f
SSDEEP 98304:kfyPB3Qm1BgiwINXE9ynI81WT7cG8BAzFYNY8AFP:2yPB3Qm1BgDueXFP
TLSH
T169967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_helper_64.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\installer_helper_64.exe
Size 593KB
SHA256 a731b1035fd27ebe033e3208a3152b1fd85e9994a9560f14759311dc62dace19
MD5 9d062dc74bc0140aa65461bc6e60cead
SHA1 e39b1e9f9ec0d982baeef13597fdf4076aa5df46
SHA512 a5823e556da9538e103237b99d35817c9f4f1980579f48352fb191b21db500891beacc4551963d5679071d5189fbd7dc9f0ba020777a2004875adc4e87d5433f
SSDEEP 6144:JeE7No2ag6bt38gpEA+BacGpxIMnkgSkQ2CCzr7OWbmo1AZb0hHKkMqqvv5x:CHVpEUcGIMno2CCzr7OW6aABT5Bx
TLSH
T1D0D48E55B2D547ECD07AC1348A528652EAB17C560F25BAEF02A0727A1F77AE41F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\libEGL.dll
Size 492KB
SHA256 007f73feff0dbe26a4efcef8bc91cd8bd31263cb474e07d3626a35ba1dcbd047
MD5 3274f0581f4d85e5e263ffe7f81dbe64
SHA1 7eec7fb5c4aeb00fbdd798b17e63b50ec6f24c7a
SHA512 649af8e7162bb6bbd15c635499e64b03c0bc5685fa21a889e7c945be96967a8adc22e15b6a370b020b61d1c902ce8a79591ffdc80225fd1a48246e9defa64d37
SSDEEP 6144:yaNob/iq0y3iwT1PdwGpyms8ybM/0Ic0Vr0BYc7kuxkHV1:Nq0+T1hUnbM/0Ic0N0BxkuUV1
TLSH
T1FCB48D15B2D949ACD07BC1388A538547EB71B8560F61F6EF02A0E2792F77BE05A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\libGLESv2.dll
Size 7.5MB
SHA256 6240ff7aaea0749a4876182292ca5891327bcb9cf401c1d081d7e9ed561bcb0a
MD5 3b42250d71e78f397e87de58179fd287
SHA1 897eb7c1d2b1b2f19c5409c3ea1921a50d16bc5d
SHA512 aec0a5d8a58167bc25ce9f2eaa73f5a935ce61ea9e847e92de605263c9eeefafd1bbb73ff9d9442963ad51ffa7151a92622d158cf1f74e0751f95bbd17bd40cf
SSDEEP 49152:cWk6qWVetTMgVQZbTob8R1QOmu9KaMtbaFsjufXe4lpxkYaVr/qCwPuMnGZM0g9Z:iWUdw+vVryV7GZaOX8Te/rQs7Po
TLSH
T187868D13F2A240DDC01DD2B89757A227F674B8450724B2CF2B9857162F7AFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\localization\bg.pak
Size 998KB
SHA256 310b7012246dad3506b5fca496e8f14c9e2fe750455e08aee9c104c62e3dca4b
MD5 95d0a3571403c3d1e054ac3c40b63078
SHA1 2978511ea2c5fa65833d50e96dba72b3dbbae973
SHA512 3620937aa44a6ff02e28f105da2b1b6eec9515843cdd570123e8ee66661922ea1c835a81eda5dc6d8f6b76cc895e97b571bbc6fe5f48b6b5b2dd069d62047401
SSDEEP 24576:KxCxeE4b3JwoGvqG4l9cI6dBBuK026g2HQ2WrZpvYAgCzQkEC3UnVb6fSIAFWVIu:KxNbIqRydBBuK0tQ2WrZpvYAmUUnVb6l
TLSH
T1B32535A15B9A649F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B887BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\localization\bn.pak
Size 1.2MB
SHA256 9ba4eab50c627aab5ea5547651b2c01b71b71baa3de6e5d54fcd1d0cdfb26474
MD5 7ac9b913d3fad11fb3436c410cab2fb4
SHA1 03361c26a007bdc589732d2eebc44419372e9d4f
SHA512 a5d979a4bb0f3cd6ff17bf04eee27b155186d90bff7e0b51e3ec5036ee6e5f1f2506e51fc79a36fd15198828c9f63cfe6e1f2d45f73cb5df95c6f99441c0c492
SSDEEP 3072:3H6YNFxz08tpmUnQ4Z8MqZIHZFQwQskOTGQjwI1U63x+TUZOQUPDi:3H6Ynxz0WoUQ4Z8MqZwYwL5jw+x+K
TLSH
T1AA55FF209C6E81B2A8D5CDC9434C6330C123AE979B65F74DDC17A25938ADC3C8DADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\localization\ca.pak
Size 628KB
SHA256 23198bd37cc02530154bc83f42f6b025e27f377390c4065a9efd1c4f178fc16f
MD5 9056d1386e063d5149feaef9a1f6a9e9
SHA1 8e2f33accece81b9d4883b17230a2e5a70ee2270
SHA512 f4fbcbee43b74ea97005fb8c52da6b5de651eb0ebd488314a4c646bdad14409c26da362dfd35d3c88f5904daeba40b242efb9ea3484b941b7b087e1e5b542a2c
SSDEEP 12288:JFKUO7S6ybGbf1bCCrz+W58rP8lpfmbVi6Z6M6AqHl9kdkcBKMe3aR4Uz1oO5h51:JM5/vY9VyLgQ6iBZnt+ja2d
TLSH
T183D4F7238BC83B760493330AFB42C257F09CA9847B16D254F5EE1A5622CCBDCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\localization\cs.pak
Size 627KB
SHA256 02f0f44077a7eee52e7e86839778bbf1cb899a4fb2fc9a7fe7e751ca0fb07943
MD5 e4001c598f951b2d77f48396d24a1800
SHA1 6ead9b102dce7ebf552d940732886697cd4a7fd5
SHA512 38751f9a9bb3c73b3ba579148c300af868d1afd8b08f457a72227820ef7eaa04c778e6df7e2d281a583a2810a6ef29105d7d91d05ca9595c9582c67548504fb1
SSDEEP 6144:EXDbFeFBgcihKMmozHJ62GOgISBaq8QtsVVpCvJfYu3qjWMqYhDaVV:EHwaxMKzHJ62GOgISMgvV
TLSH
T10AD46C1FEB936439584002447BBA5228BD5E83140B6EA9AB7CCF9C91227177ECFF1D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.56\localization\da.pak
Size 577KB
SHA256 efcba591c0231a2edc4097b2128a06171006956f826f865371cc359538abfeb2
MD5 823a7cf5144e9e07fad86371e4971536
SHA1 d85d6f1b69f42cad61a66df44df308a062d0cf7e
SHA512 8f49c9280798003534cfd35dc8894f0b0354fdaa1e86a076dbb3ec9d83e6a210e05f73093d9f1bcacb9109d9eb95cc8282b9f626f8f612b4350d7e40f08a59ad
SSDEEP 6144:Or2hiDIXtUqCRLj4ms6aUMwBzVWJkTxLxVtsl0gmd4AdCfwgKszZh50RQgkSCEdF:CNS2R7+U4k9NsrENRQgkmOZ7ZuRYN8
TLSH
T167C45A4BCC9C333F89A90764F6118DABDBAD543CC684664F75D8903A16CBD6092BF2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs.json

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json
Size 1KB
SHA256 cb82724ddcebb2dec4a0688318dfda5241da75723a449e0c90f92ff9ed25358a
MD5 284d58e2c89e3b41e241a8cdfb6f98a8
SHA1 95467ba18d1f40e847768444f54509495a84e884
SHA512 1d7603a1b65fc3d85b1931bc09321cb528fe563df5ed0e5aed45c97669b4bee3a408eb48f8039fc93d831486a49a5c067d3feb1dafde1c6ffce48bd2fff8ee61
TLSH
T15A31E860411250B3BF31A35FDAD73A4EA2072603942830E4B7DB090E68EBCD70B67D17
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs.json

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json
Size 1KB
SHA256 d5fa32f0d331a831a986a4289ac85a8c87946248a15ae2432941b109fd35ea19
MD5 5608941cb62648e3a1bd312b37e329f9
SHA1 fc9235532b56e946c11c381457dfe27ee33d0c56
SHA512 4eb5bf182447ebaef03117d936a12634dddd3f0eaba6b139f298a2a1128f5c402f4aec2b420db76a928040530c21c69c9f8be176bddee2140ca02994a240f5a7
TLSH
T13431C860411250B3BF31A35FD6D72A5EA2072603982830E4BBDB091E68EBCD70F66D17
MD5 SHA1 SHA512 TLSH

Submit Download

Opera Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\Opera Browser.lnk
Size 1KB
SHA256 053edc9f94bfad7ac98504f24557909a0ea6b3494d525c6a1091bdc6b79333af
MD5 d49bcc75b6c61c4644621d0345fd78d7
SHA1 55164ad36025ec0a9f23bb9aacad1fdfcbdc4fbf
SHA512 bd8855516b9918cabc1460d39d46c9fdd97a54389680b21d7692eb6594a6a850b29232fb7f4a1897532d0741a18419c983dd01b8450a324a3a82612cf1e0dccc
TLSH
T1EC2121462FCA2712E3BB453664FA26169166BC62AF469F4C0094C3843DB1202EDCDF2F
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\installer_prefs_include.json
Size 224B
SHA256 f799101396e58ec98238b81669c288b0649788476fdc997cd029cfd5239c8aad
MD5 a31327ed38a2e2aa048700169e5c9e89
SHA1 cee83a9db48bf9c0d963bc6d03cc125af5cc4ffe
SHA512 b302790a45f5cefca7131f81d2d15976d402a48147960dedb5eaea136205c7a5e04635521f08c63f7ab53f1b9dd283e575240076beca5f392f47f0522f105fef
TLSH
T195D0A755802BC0E365B00283783633DDC20B1B038C716899B3C71125C07DAB326E6E1A
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\installer_prefs_include.json
Size 239B
SHA256 ad0a70852936dbf15eeb5accadd7acc1554959df5b85898911e4281e402e287a
MD5 d89bea9bbcd4817b77b7b90014f1da87
SHA1 21cdef3b05e461f645e198bb92f7c787ad0372dc
SHA512 70f794b897b35a6d15559a05cd358e98d2887096c60f7cac5c2e1d065e1a2c39618d64cc81b9fc2c3380075705441c3856b0df03eb6feb4396e8558ab2b1cc96
TLSH
T1D6D05E59802AC0E269B00287783633DDC24B1B0288616899B3C72125806DAA226EAE1A
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\0d903fa4-71e6-481d-b153-6c09c4dacda4 Opera Installer Temp\opera_package_202608150520111\installer_prefs_include.json
Size 1KB
SHA256 28780f98be57f11a6b4991c9b502e8de4c9c1a3c7300f7399a40fa6ce22ce11d
MD5 1f0e92ffaa2f60afca27cd6f97b23694
SHA1 4acc4ad7e75efe96f11d545c4a79e2f8c9ccef5b
SHA512 e25aed1de6b6dd027c1c6a21834058e1d54eae59733663465a59113cd80bc6175aad2c857c5edc29cbf5e167a0ceba5714618b7051b39eb5ec5e3c9bd9f408ac
TLSH
T17611B6A45001F0536B30C24FD9BB2B8EE10747039C6024D672C2481D88FFDA30EA592A
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS058B51F9\installer.exe
Size 8.3MB
SHA256 3e1ee4a6d766e4e155d4818034c8e55efcfa743368a4e96a3b966badd7e09e14
MD5 36152668ab7d4db9a0015916f2eebfd4
SHA1 7f551a41bb0c09ef1dbf56b76bcd68682c059435
SHA512 0d1ba9f9533c23f5b089ea5b2bf21ef74e310b64e04ce39742ca7a0a32cf8937ad4bd579cfa56668ef232e3ea569fc0a293ced570d7d85311018c0ced893f1d2
SSDEEP 98304:WfyPB3Qm1BgiwINXE9ynI81WT7cG8BAzFYNY8AF9:0yPB3Qm1BgDueXF9
TLSH
T114967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 ea0ca4118e3769c66bf02e7eb0d62b67da8fee7c6c4ec89a2eb2f7cc9dcca0f1
MD5 252c0ce576dcf58342bb8635d185f275
SHA1 29e8a26b29a87a47d42db70e3dfe0afb23038f25
SHA512 072525acade6e0f8a63f1a326d3b43c66a97cd189b905a06970b5d9cf91fe35dcf9a28fc2c644f22e4a0275d23670e9f97b0d1b1c4334d9c7a600ad8dec43dd6
SSDEEP 98304:vA3624H6UA7suEqszIwzNfnKXevaMGP/OUYXy:c6FaUMdcmtlqy
TLSH
T1E9E523127B809879E62210335F15E659977DB9201F26DA8BB3D41D5F8FB0282B636F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon_opera_one.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir200_752514121\CRX_INSTALL\favicon_opera_one.png
Size 2KB
SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
MD5 cd78c5defe6084243478de9874682e1f
SHA1 708c8c0649039ce9b3f8894d00b712d65d488ca2
SHA512 96744c72f623462f1c64c2e49e7a2387846ed65a78d94841adb3bb5b52f27d28f657ca3f2910b6b1b338a032a9b0e0ac47d23e7b25295d6841480b32268f4db2
TLSH
T163414D878974A4D5FA41D0215A037D9EF9BACDEF40970E5010D9043A427AF5573AB33F
MD5 SHA1 SHA512 TLSH

Submit Download

Icon_Light_Neutral.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4476_1247532332\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
Size 2KB
SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
MD5 0566b67d5fa120d6da250a92577c8873
SHA1 0baf54c5f6a7b8cff4c82d22be9113c43a099c87
SHA512 9dcb904ef68419b2462d88133e87d6f4258d8f53f05ed12868718740d6e9467ab2d8769a79727c3dbd01c6807aa5e4863f1874465a7dc95088bd724f9d897fb5
TLSH
T1CE516D6D716E2332D0EFCE2E04C6860EF8680E9C50489454BAD506EF8905B9C9DB33C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 a1ccb645ea05b18e526868a8b2af2370e2ed65e5dbcac2e9768bb852258ed6cf
MD5 c7a7db850256e1eabe5dcb0a80c87c70
SHA1 94430c6fe6bdeccb1f4dcff85e2d0aa560dea3b2
SHA512 ba57b867f24191c121d25ff062619a40af48d5aac7c4422dabcc40f2e11e0ff8e68fbcec54a189a31d806628f234a13af26c898fedd33f17158e18bae0be05a2
MD5 SHA1 SHA512

Submit Download

0a45b5bc-c2a5-4c3b-ac7a-79a664a21e28.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\0a45b5bc-c2a5-4c3b-ac7a-79a664a21e28.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

13cf06bd-dfe8-4024-8fcd-a6b4daf378a9.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\13cf06bd-dfe8-4024-8fcd-a6b4daf378a9.tmp
Size 608KB
SHA256 a2d743501274d3efab0bfc5a078a427ed1702f9741aef71f6b0282b44c3aa7a0
MD5 0b8ccb38b308e364fae43abf3d5fbe7d
SHA1 503ebdd7a5bc6057b87ee0edbef4b73359b1ede2
SHA512 c070be3e603ea6fef64312899b54cda4182e0f4765f8f723d5d6e85d28d424c769ac85244b5f2b489aca9e19d843dd913ef1cfd63fd1b0349e664d088286efa2
SSDEEP 12288:xjEWvMdfcwr+LcZe1b5aY02tsKZKEH0tNpwx+h5Ahbv+F7y+8lOcIXgpSPaXN/Oc:cEg01
TLSH
T15FD497AB868C2CBB5F8136D560CBBA5940C2701FAE8D7E59E780CC4CD2A59673B7C117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d0ddd12-c02e-41d9-884f-8647d395fd2d.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\6d0ddd12-c02e-41d9-884f-8647d395fd2d.tmp
Size 10KB
SHA256 6a61a0105e90d991543643ec2c5231a1fd07ae1ed8006476a5a38b9db3d4cb9b
MD5 0ecc309bbb16f6034d8a8517b1a4ae5a
SHA1 98abf5536c9a038856fdf042b302660505440cdc
SHA512 e817ffc0f0400567cf73c5f3ad0c59e0c3e7d442d380e8df39836fe5fe8111e6c112c1eedb0180c9ce5e5e1bcddcc4acded4451ecb9aaf068c3b21d6fd5d121d
SSDEEP 192:+IZGKGogbhlxXMInZRquBj3UFDdVMIwV/179OPGub+WNOjc4USC+yIsn2agv43:+/XW+pUnevA
TLSH
T12C32438A98645D7F0CC66666F651BF57F3F81021A1626DD4BBF8CA3C05CF6CE2122983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Bookmarks
Size 34KB
SHA256 10113e4c5ef11a50e41cc40a0885f15fbd506d9d1777f369a2e7f9a4ee465b57
MD5 86f4ba243f01922de9203519aae966cb
SHA1 a0a60548a0a383203df6c6d299c901d03e178e67
SHA512 b231907e39b77861a19d025917c4f8155f8f73b863e5e3afc8b705359d01e7d15dec207f0dd7b068c978d25850eb72bd0de026a31553bb9b108a245f47557bae
SSDEEP 384:ZdkkNxDIBhc3ITWkH9OYqusOExgHODjSTTHlAJCyWp9717yZ:HkIHm9cPkODGHlAJCy896
TLSH
T127F2D737C0025CBB817013D664FA661BF78A332F59848D8B777CD88D8F75927625AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarksExtras

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtras
Size 160KB
SHA256 d26ffd2cac2605b8b61ee38d9510e94f9ece6a756751006006e4bebd8749e55a
MD5 eed653b42f5b31a0e658dde09a0f788c
SHA1 edc7f242cbc65998a54dda6e61f2e02ac659f116
SHA512 b6ead4fcb214a4cf2c7691689af7ad4fd3cb7c74aca1e3bb33729860f6a6a8e7a935acdbd3f85e914a5354d69a3761d878e8971b2811e7c6ab0fc26a5aa88cf4
SSDEEP 3072:LaeC5wQuI95lsiY/Kg5gic/1b/B4Zh2tSOv53xJx6HbCxz9DNwkhi:OeCWqPdY/rgic/1bSIEOv53xJc7Cp9Zs
TLSH
T10AF312B69A830E6EDF7DB73B572D2E69BF1D0E5706C5219908A5EFCC1203D109C62DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e37378f-ac63-42b3-b182-e2cbba6197ce.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\8e37378f-ac63-42b3-b182-e2cbba6197ce.tmp
Size 48B
SHA256 4c076fa3757919cd3dab437578d729c04b193d383f95c093c5df7a7cdb9cf45d
MD5 9232912159b0326040bb0d9c973fc95f
SHA1 10b5e64a8fc58837433c431edd4ba72a12a13623
SHA512 5c4030e974dbcd2ebe091cf7bd19b88576a19479d25b015b964dc8e43a67c0c9fd5e360821d099a4359b831ad7078508e51312c3d13eea08735e9d025676e837
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b84dcb249531ed5bc50e379f37ecc6adcbd1c0c6de4cc8eb35babaccf6918e6a
MD5 1d31d62b4712e60d5f646a53df31dc18
SHA1 4026b7484bc0df04048471fc032c9cd77a073b82
SHA512 2b0ee4ee29f8eb42eaabd3f5b32a507306ca7f384f134ec3644455dd820d6a98b4e1a14bf7a4ca026a6823b08d2c4bc7cfa62a251c4f69140b45898fca5a720d
TLSH
T181D012B420F80D36CF450E7732E24D952268391B0F5F073755525EB556871C56B2D110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 cc2d8958ac1bffdd83f2826663f2bd1f5d439a945a699bf5ebd788b4b9d00372
MD5 07d0445204f00bb1055edc6202f95b39
SHA1 b813f32f92c274c0be955c333d8f9e90cf3a649b
SHA512 da32bf166e3668a6b2725bdab8c53bfacfb9ce46ab3137612d1c429b51f85ce204f6057045a77ed5413b92d4ac349db1479bf91147d56c0932cf6bcf465d2e21
TLSH
T1B401462954981BF7DFA9CF33E4961D10027B35130B0F1B2B4EA27C5568AB2D4063B02E
MD5 SHA1 SHA512 TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.7_0\main.js
Size 46KB
SHA256 e1b3123f37dfe988a8a22427e98d06cdf472c23429f6277f68c6eeb1626cd54e
MD5 3a4b577e6f2150e055d503fc17aec243
SHA1 6ab613cb92850a343caf28887301748c73b34722
SHA512 d4fb08f3423ddb5501e2d50c4b3c6cec5be34c9b149d469074119b144fa54a317199f485a8dc7eb650fa7762a0be79b49a2d99b4cbe9dd8408a632baf0cb2537
SSDEEP 768:DvKIO8ifSEWA5W847cy/FWpoMz908/lK85aipQqkUlVZm5Kdnr4WavCiwdC51SqJ:un8VEbWXxYNG8/A85DQqkslr4JPmCHLn
TLSH
T1F22328996269687E0BC2D2ED925D1313952460F8680D84AC723CDFDE6A0FDC2127CFF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_128.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_128.png
Size 7KB
SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
MD5 8723b83f007f8c910ae071e275f99383
SHA1 9f76b6719f4dc7ce2ae4ce96a8577481735f1ecc
SHA512 62256dd55be00b1a70e9afc127ba2079fbd563274c6829739f99fd02c6bcd2b2afa21337d8f58a7d64a716f41c0d739ab7b8f78058255bc1b59450eb0d0bdf4d
SSDEEP 192:mbNUdF2i9HsyhJ589/J6sdWQG1i+5pqG/LzPYehuNBpDxw:TfLeyh09/J6sdWL1AUvfhOm
TLSH
T1B8F19E690531CCD4B5B99F755309C0DE2136CA98A431AAAEE0CCF1CC3C573697ACCAE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_16.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_16.png
Size 653B
SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
MD5 e4fe7d0c1c77bb00d492bf59196fe3d3
SHA1 350335cd55b2acb2b8957cb79257375513b525f1
SHA512 73b6ed04cc5b46d700bf34bce51f50b19c89e9310053a473f577516a270b4ff7ff1ce954c18430c2625439bffed6153997a08d1aa6d3a4196b4ae5ad4089d556
TLSH
T135F0839A772C8958E9DC5C30B21F4297EA8C22E8C8431601A33F52313E63812138F08B
MD5 SHA1 SHA512 TLSH

Submit Download

logo_32.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_32.png
Size 1KB
SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
MD5 3e4cddaa76d8fcd9ac7b64fef89d4b74
SHA1 3a44b23b9b8f950f9168361da56cf8f86958a408
SHA512 9a6317ed1b9e919b3a6e3fd260f88b297b82498d294d7c86d1a40c20c35003694865f06632d1bf281417418b48122b4e01296e17318f7fe77612b3a716417bb0
TLSH
T1F221D8DF8464ED2E8531C8B3C14354E5E2BE94B3E47B9479F06BD8510C307958783E50
MD5 SHA1 SHA512 TLSH

Submit Download

logo_48.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_48.png
Size 2KB
SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
MD5 1a3f93acc11338a092785da97956c034
SHA1 ed1786563e53ad2fc076edabd25accb4ef241540
SHA512 7ff3c3eb9b7e55e799bc8c8ca66225fff47c52d85e1326f99b2e7c1747624462231e8dc9c09cc4d6e675d072d8da41ea998f16a4576de76c6575cda271255e85
TLSH
T143414AB201335E202C334219CA7203E2A80CADB0C02A7E91E0CCDBBACB00DE5E2DF506
MD5 SHA1 SHA512 TLSH

Submit Download

logo_64.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\icons\logo_64.png
Size 2KB
SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
MD5 9c3af737a428dd3daa949313d69be52f
SHA1 c24aa988066fbbc4da252b858fa738e20cc42c07
SHA512 ed9f869b3912eb8bf27624185c3ce648b5a586576deb7b1f9a0b6770fde1109a81fdb771a76f0902913c55aef7b6020f386dbd92a06c7ae106ca5fd593295c0d
TLSH
T129515D9D4EA1ECB15A2B46339AF935EBC5F0B37A0B2C277D60C94437A9C255231214E2
MD5 SHA1 SHA512 TLSH

Submit Download

service-worker-loader.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.6_0\service-worker-loader.js
Size 49B
SHA256 f8eef7c260d4743817755ab4987619c18d1266f27d2435f32ad3f50494a9058e
MD5 98ba3e7390f54d7b7c944a81543425d9
SHA1 017515b72aca14c87c6731b50ccf2ae8c1c25566
SHA512 7569a6aa2521d00b34f4e929b3a1d8fd72f5c4f10e63524deb90414be85ced641fa55299192e6c3646de1a41649b378de00ec1fb54a222e708de8236d63a490c
MD5 SHA1 SHA512

Submit Download

favicon_opera_one.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.60.0.2_0\favicon_opera_one.png
Size 2KB
SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
MD5 723cf51fae375f557b2f891a2ea603ef
SHA1 40f374149ae6f8f5b847be59ba019744c232ebd5
SHA512 d0f64a88cf62642adf30af333f81481f43fd2141c63a135162152d1c7fa705b52121cac69edab0f93d35cc425b43fb6d6af2adc4323e5ad8e11109a423ff6eaa
TLSH
T1D4411A8324F7F9A0FE30E5AF1353E0454E655B9E2B512738128D08B4A4BA6DE92D202F
MD5 SHA1 SHA512 TLSH

Submit Download

reader_mode.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.60.0.2_0\reader_mode.js
Size 112KB
SHA256 f5b63ef3854271863b5f3d7c06b7a6c6b428bbf87dbb65378128731114c21ed8
MD5 83018e617f023246b8c40e7decb4966f
SHA1 7020a54b8d8fa2baca72ae2c8726ead79b28ba5e
SHA512 8c3a09ca164c9865e9a42fa2e3aaa5b86d06895eb7c59226f713684cf0f0f255134bb497c595c6e6925eeca62456b23ea9248dc9610a433ce4e169218c9759e4
SSDEEP 1536:Ska6rka6MmEctzRw8qxUyIVGjYG6xpvAI3z6A0k5miSZ75U66dpXdd0yUY70Lcx6:Ska6rka6UszmxnS9lbv93NddM3prX+wH
TLSH
T1A3B3D9ADB3927199928320E502FB0047E3355D451C1A5038F669E5DFBC24AAA62FFF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spotify_frame_interceptor.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.60.0.2_0\spotify_frame_interceptor.js
Size 5KB
SHA256 2a56db49a693f567dfa82d3bb47a48565cb99b54ac51b70a00548edc2ab366f3
MD5 8d777049b4e15f39b899dd4cc4345706
SHA1 077a7963ae4b748bb561ecd6b0183d65d83457e1
SHA512 729530bbade4df80fd9add97fddae14ea7f5c069c489bbb12f69fac8f7ae5cf3723021a5936853255cecf7fd14c7672af56496c395f7ba399e443709e6620797
SSDEEP 96:xSVa6rQaSVa6pW38bo5bYe3m/I6FScpoV9FzKovz1fFUAJxuis1Z1TTta12Ho6Io:xka6rka6Q3805se3m4XFzVJFsL1wx6z
TLSH
T175B1A301819C4C7D8FB5029A9ABE135206DE2283787BD4C4EFA3C475A7253CE9213BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\background.js
Size 86KB
SHA256 bc24cb72eda19eaf9ee195f014bd6247e826cc594e73461b826c6bd0d5f50dce
MD5 c8b19bb6ffa9ba9d07b010ee2483d6fe
SHA1 db1af85512d439f749c1fd64fa8f7dfbbe5f682e
SHA512 841d08ad1dfd23a85b3749dcec341c665457e0648509821ac140fe0ed753e8b0ea4a24e7b6ea5f06958f4ddb0b65f7e58250b783eea11c321fb975fbea63db46
SSDEEP 1536:PYHgfauhQ7F7yEPlL65+aSWr0WUvpyiSBwhmSvGj1S+f8+:PYAiuhQOokiSBwhmSvGZS+f8+
TLSH
T1969308CDB6C7F26293E390AAC03F101FF23A6D19740D4454B626DDD1782658EA236F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon_Light_Neutral.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Light_Neutral.png
Size 2KB
SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
MD5 bf24b39c7ecacb4ce180d5013d771066
SHA1 8b05f38ef028f9a6ca5411dcbc347d6672c252a7
SHA512 2398ba9b4216289bb2de142d614f312585f1e14e759d211ca169e1e54248761a78585f8ffd0de5f9112ebb349140f0346994b8a52a290ae22768a80d19cd8a9b
TLSH
T158515DCD26176426C397F654D206052A4F0841A72EDBF6E949306CEF9C53E0FD6DD760
MD5 SHA1 SHA512 TLSH

Submit Download

popup.js.LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\popup.js.LICENSE.txt
Size 1KB
SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
MD5 56868fb04ec3f6436a450b0be0c49947
SHA1 3114eed847366239e1b72b45af410bfba81bde4b
SHA512 a2211ab99b6d04b7f0a7c5dddeb8156c7c24e8ff0b2860cbddb6273d25089c7e066ea6be363a610553ee2b275ba4f7750f9456b30251000596544330d8262dc7
TLSH
T1CA215B5A35F53633026149A2670793CEAB0C11EEA4BF347BC4918374AC344FE8394DB4
MD5 SHA1 SHA512 TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\rules.json
Size 839B
SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
MD5 112b4a4c6143b507605be0de6f359ff2
SHA1 4ad368eac9b4965eb0389d2da4b2723016c8c69b
SHA512 9afaf96cfcde9688664d33f37168b9c637e414c3fb768b0c70cdb19cefcb42089e8f464a8d32bcc21a140414c0557fbc02c12a29a5eb662405d55ef7f1781b2f
TLSH
T19301B567C4255C230342217CE42B0719F970E14B6E646E2F3F9D845EAF5E47EAA7238E
MD5 SHA1 SHA512 TLSH

Submit Download

2f09c960-44b6-4c7f-bdc4-6cd955785e21.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\2f09c960-44b6-4c7f-bdc4-6cd955785e21.tmp
Size 27KB
SHA256 b8f0a6164e126d0f70798a96f456487080b5473bee571bb9594600f8a53901c7
MD5 c7828175f89c5a3ada16fc7817c80af8
SHA1 e6e6f4dd36fb419cb311093dadf8acb61db1d30e
SHA512 b68e7b8c42c6d571487841ad41148f7452e970b295516fe025744f7bbc8d0d7986699b41d5f71a6b43fd4ac28b6a216e24c19820ab01817c4bcfd50677fe7541
SSDEEP 384:OwU2+wy7Pxdr6zfM1dGSwrI7dG91rfprU87MJzeax:f1+V7jrI7IeywMoy
TLSH
T15EC21EE360CA08D9FFDF25F155861ACBD09BBB774A262178138363A5D3E4D20D5ABB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d661c9e-5a01-4112-962d-be6e461a8024.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\4d661c9e-5a01-4112-962d-be6e461a8024.tmp
Size 27KB
SHA256 aaa2c3089c7623aefb9025744747ec651dfa14d9decbe63ce941785b4202f1e6
MD5 1f17cac9ff7b6851ed5bc95c2625596e
SHA1 1a2f1ff883d5110a96e252b88784a00789e88add
SHA512 87539de5cb743b9823566a3c9bdfa8e43c4d78db761b40215e3483a8e0e155af22f057c4de290d9343459ba44a5a5cefacd53aa4fdaf032ee16f88e7039157cc
SSDEEP 768:+IsX2btgY8GIZbTbg4wjs2W0dWvlSNqv:+X2btg3vZPV60
TLSH
T117C2D773FF4CB61EC5C832B4C04A874561AFBF8C61725607B97C7E997B4E0438856A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c72405c5-c28b-4b09-a3c1-ea9add6a7cd3.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\c72405c5-c28b-4b09-a3c1-ea9add6a7cd3.tmp
Size 27KB
SHA256 1c2d3bd473e1870389f6737747a94d5e852790d686cf91b5e22ad83b190eefa3
MD5 ee77c4eb6b9e8b98db1acf41ba32c064
SHA1 c44316ff0f61c9a7f27f72bc31925ab992de4f6f
SHA512 ac0d2ae2afeeb0d82f75e86af6580c804c53abe3701734c7ad5e34bdfa4aa9144fc293a4c3d32207d3f0c70b9e3744ed8bee09cfbf96dc8ac825734537d04818
SSDEEP 768:90haQ3glH/EKEi+B4MfgL2BYb8Ohg70q6XnKa9UgEUjJY99yVnX3akrtSX:90haQ3glH/1Ei+B4MfgL2Bo8Ohg70q6m
TLSH
T1DEC286C2D8C00264EC592F75257B1D39112BBFBABDB8B24DDE4DB1757BB32D24126A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce78e09d-a088-43c6-b150-6902fd7f53e8.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\ce78e09d-a088-43c6-b150-6902fd7f53e8.tmp
Size 27KB
SHA256 1b6cb01715a2de1373f9f3e194921621463532558767bb5d6e1902e9b368ca5c
MD5 20592c0bbc8cff757ec1ba508ee277bf
SHA1 7465050f95649e3bf662ebad10de27a9bef6a3dd
SHA512 c50dc6adc0aa4f0b80bfcc9bfa774c5d1a14e1cd3e889c924d3bfdcfa16c96b34f80dfdadde662ed87c0f33b37f59eaa151706e949641a24104c3583fc962cbc
SSDEEP 768:1VUpNy4heVwCSvh97oYHSI4R7VIO8BkM8s:3UpNy4heVwCSvh97zHSR7VIO8BN8s
TLSH
T149C2FFC2C8C54658EDA95F3460770D3D466BBFB9FEB8B54E8A8CB0717BB32C20426546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dda8fb3a-c2be-4ffc-9a17-0e9aa7ec9672.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\dda8fb3a-c2be-4ffc-9a17-0e9aa7ec9672.tmp
Size 27KB
SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
MD5 dd8e6df155a2ff5f53f81679d8701c70
SHA1 392045fa8c2bbc94b569ea3a70068c8dc8d34826
SHA512 bb1b9a80f15288056a5792ab509451e841c7ad7b654fa7bd5b862bdf298ea8421c201b237d9cb4f0b64d46c40d0bbbc229161730eca3d5d957e12be515764145
SSDEEP 768:eF2AR0FEDVua3n5F5chXL3tbF/a0YFFle/Y:jFFC1qL3rYFFleQ
TLSH
T1D2C2A85294CBFA07C379F6734ADA0DBBC3B38D0BAD904664D2E8B47CD8B92845D045AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e21ec33f-a386-423d-ad7b-aca8c30500eb.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\e21ec33f-a386-423d-ad7b-aca8c30500eb.tmp
Size 27KB
SHA256 353f070543d1c43247d565c23d4c0346a8d65d902aa7bae04c6ae5e64bc5cde7
MD5 ccd9f3e1f74f2028805e3fea6ad9b934
SHA1 f5bc2ea0c0c3d89c7f37792cc43fe592f8bec748
SHA512 ce32e58b002e2f7fe1649ca2ef4dab2a3ff9c738c11f010a9a837a5e7eb338d03672c325636c87659fa19f75625cebd9dc2602b428bc6d1e2d0799230d81c824
SSDEEP 768:3F1F0kh7RCnrrh1q9i1coUSeJ1xM9eK3ZSk5:3F1F0k9RCnrrh1q9i1coUSeJ1xM9eSZL
TLSH
T179C297B2D8081F14E698B835EB7B9C0A81F8AD2D1439250FB767BC507D9F64EC983746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65df5acd-2bb8-487c-9d7f-2c6b9ae82e94.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\65df5acd-2bb8-487c-9d7f-2c6b9ae82e94.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
Size 965B
SHA256 b35f3143739e16860e74c69480bf011799d947038a5ea0d7f7dead7ec2977b3c
MD5 6eb80555c6015aa6922efcfa428b0487
SHA1 95d6ad9e35cb5a9aa4524279f537081edd25a369
SHA512 3c148eaa973a7a2e62a6cc2438de48d44c35c67df1ac24ae7940a813abefcc13032e71cc2ab7df0d076f593d73593974862298072f08a39b9e56ff891ab82511
TLSH
T1CD115EF653706A7D9B11C3F0E914AF1FCE5D1411839C787A86906E2393B3861E400B0B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 10KB
SHA256 c083cbe5d29fef7ffd756a4b369fdd88cd474db5b530fcfc0838ed4c2b8774a0
MD5 1759f523cbe62efeb21fd73864447520
SHA1 f97447dbae9e7174172f179601be7b7d379e7cc3
SHA512 4c165bf68ca35dbd50751cc3baff05d091e11ce8ea0990c79aa0d1fd4f2fcc4280f43066731667925ac25fdabd12d12dee59b699e794a24cf796e723d384abf7
SSDEEP 192:KeoIZGKGogbhlxXMInZRquBj3UFDdVMIwV/179OPGub+WNOIc4Uee+yIsn2ag14M:s/XWTpUne1J
TLSH
T13332324A99645DBF08C6A566F651BA57F3F81021A1627DD4BBF8CA3C05CF2CE2122983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 15KB
SHA256 46cf2e8c06a3926651fa68b17040e8441eddf3756977053d3aef2208ee3d6da4
MD5 76bd68fe4ba0473096d383da781e5010
SHA1 063dc6cbd66d5b203d1cffafc82a0d02f74ac683
SHA512 ae2f45cf9bb124c8326ec27e964da309bb4ecfaaecd1f62f906bf0511f58618e65fd1c2a43cc8002b9767f683063874f7f87d726cc27e0ded600674b4b4bec52
SSDEEP 192:IleSMHRLNhlKR27MzdO4ZJTRtH6JyNsyGKGogbhlxXMInZRquBj3UFDdVMIwV/1d:InCXW41oxznpU07WoZ+1j
TLSH
T19F724287A8741DBA05C6653BF591FB1BE3E90022D2526DC4ABF9CE3D00CF2DE6112882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 16KB
SHA256 a0cb9090836a6879e30e8354365f47b8e79b271383b490cba3b7f54fb7f240cb
MD5 d5a0a8cd76c34924cfb1b4b398489880
SHA1 7cdecf7fe9575e4dcb3249f08ad1cf7d58380de1
SHA512 ec3d736e39007c18f781a353cc12782872c3aa0d6194ac888c6ec90687a1ce0246b6683975019c996825f81cb8a450c903bbf37fec3f27257350e039a6698587
SSDEEP 192:PjseVMHRLNhlKR27MzdO4ZJTRtH6JyNsyGKGogbhlxXMInZRquBj3UFDdVMIwV/v:PjJCXW41oxzCpU07WFZ+1j
TLSH
T1C9724287A4741DBA05C6653BF591FB5BF3E90022D6626DC4ABF9CE3D01CF2DE6112882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 15KB
SHA256 08891ee1dca707715b61fc0d64e0829b8859097b753416ab39e4d8ffbed9df58
MD5 082a3c6f6da17664c2ff8c9b9c101b22
SHA1 f8cdda2e5123511ca71efb6fedfff7ce63869f34
SHA512 165459f331dfdc69770f50097d2d9009b30339ae51195b18d18e9bf81a0c6515357a9eca191385542eaaef6ff49fafc5646fc6176a298e9d450faba6864c200a
SSDEEP 192:IdeoIMHRLNhlKR27MzdO4ZJTRtH6JyNsyGKGogbhlxXMInZRquBj3UFDdVMIwV/T:ILaCXW41oxznpU07WoZ+1j
TLSH
T185724387A8741DBA05C6653BF591FB1BE3E90022D6526DC4BBF9CE3D01CF2DE6511882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
Size 111KB
SHA256 dffcfb75d03352d5c2753c00e7cef31c987232be49e8e04ac200586e883698dc
MD5 95a2feab2ccc943e2dfb1b1f85fbfb1e
SHA1 739a064b10287f72a0079fcba18405081f81cc52
SHA512 7227bc1a6cd1bdcf98604c6656514e6bf18d7c475722a2c8118cfb150b9d14cdfee6985cf2e46c5071486c6db12cd077885252be3fcd98e73b622e1d0eb5cc73
SSDEEP 1536:XEYwsS9ds8JaqdHMHuBhHTOHw7tXHnuzHnbHLI1Hk8uHjH3fH/rCCHrCkvocXTrN:XEYwfdsI7hBZawW8BJy3MuA+5tG/5A
TLSH
T14AB3F8EACCCD8E758ED88BF9DC36AB5B88940115AF9C9F14A7F9405C03C5A89213F587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
Size 86KB
SHA256 2059e83f9a30869ec533fb5dd86f1a18939ca78c80680a6ddbb853cc8ac07b55
MD5 d2b4ffcbca98262a7b74aa7718dce478
SHA1 438ecc207cd8af6cd8a4ae5619e822be5bee9c63
SHA512 d4eb4c7a58f0dd8e2be194d51752d277aa1551b593e9d061646bfe5a405e1a548ac6bfc3b985bfa2fd16a33ea1df0271a9c4c504d39e9e1f7cfb2dabfed45087
SSDEEP 1536:6HMHuBhHTOHw7t4Hnu6HnbHLI1H1H3fH/rCCHrCkvocXT4HKHKsO5bUHoQH3H6HG:YBZIwkmy3MuA+5tG7Zlj
TLSH
T11D83C8E7CCCD9E758ED88BF9DC36AB1B99940005AFDC9E14A7E9805C03C5A85213F687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b4fd8111178d5b1_0

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\7b4fd8111178d5b1_0
Size 46KB
SHA256 940051d40a06fc3c5f4dc351b6f28213bb338088eff6d93a024d6f810f2270cb
MD5 2aee8e68e99188e4271bfa9609fd828f
SHA1 94620f647316a41321a9d6fe0900bd02a77964a7
SHA512 c26f11853e1934cadb33cedc8bfdfd53cb7ba65a4afefa930034fb64778866ae8e8d2ccd60f221c4f1181827b1dbade0c680ca473f4c552d8bed57ff8bd43510
SSDEEP 768:OvKIO8ifSEWA5W847cy/FWpoMz908/lK85aipQqkUlVZm5Kdnr4WavCiwdC51Sqc:Hn8VEbWXxYNG8/A85DQqkslr4JPmCHLW
TLSH
T1B92328996269687E0BC6D1ED926D1313952460F8680D84AC723CDFDE6A0FDC2127CFF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b4fd8111178d5b1_1

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\7b4fd8111178d5b1_1
Size 110KB
SHA256 1dd53eb6cf18af38b0c86b9a79f54fcba2af1629e5d331e642ad570ac77fc741
MD5 70247daa2bacdde197cdd9e2a8fe77ba
SHA1 4b83218978d73df98e11048e65de2b42529f3d37
SHA512 5dbb819a625b29b4bcff7a44b823385b34cad804911bbb68f01200017c030d45aa094be7a5d988b318a990d1a31b8cb514367607279b31fe1c19c94c1adf1251
SSDEEP 3072:Di02nifMc4sl0f6BvefGpclCUpKattoWZ+n4QbTdd6Dk6p7OVORGSkVAG:XuOCbB
TLSH
T1BDB3E76A6345D53BCD6A47B600239E1B3372808E3F86A31B1577E33F1C1B7F689A4856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

782928d0-d815-4a80-b20a-bf57ad485297.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\782928d0-d815-4a80-b20a-bf57ad485297.tmp
Size 72B
SHA256 7541e3a54969ebe47e45d18b9261b80fcc252ebc5642990c3aaf4417a978b501
MD5 ecac89c701ab57014c22c23610afb196
SHA1 92b9437dc8cba9ce69d3a6c955053add2de21a3b
SHA512 684846f72c6a7a63af40a129acf793ec5017ecad9c99fb803f131a1e5dacc8bf7a55ea416a29125b0b8f165853245c4143e346da6dd60d8a270790b70bd98ba1
TLSH
T13DA0022203418112C11017F42C8187883231B9259707433776D84366CC602A14B15554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 360B
SHA256 ff91c9f05e10fa80f41c37399a216be8f30cb2d512583d26e67f2f676d24e8a4
MD5 bee9902a45257f48abdff7dfd6b54b89
SHA1 29388403fcb15e3f6b6dc37dee92552d8fe00302
SHA512 10f648a766bc9630a6777a1bb3e5ee92b1c7437fe7563c5d67becc4f6f594e2bff4735b56c03d5f0a59296278342299f201513b2980ffd888d77faf4fc2f5478
TLSH
T1ADE09703CB0D34CBC580A334264B889A733ACCB1D30C33C2403428B91CB17128D83106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 f15e510fb585b3b37febed6e935f71a858c39a8fa29ef4f92db122e260840306
MD5 39ae03c80029817d6ceaf7fa26ce08cb
SHA1 7231447b33dab2dc26d811d1eec897d8ad963505
SHA512 c70aaba4af0b41bc2fbdd17286120c77713a4d933ca329ea45083d141176968469f046dcb2b7b19ae0eb1fe3266856356325d87cf6f1d561b39b6e365379a2c0
MD5 SHA1 SHA512

Submit Download

eab215d3-1a17-4e7f-9b2d-15fcbfacf0b3.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\eab215d3-1a17-4e7f-9b2d-15fcbfacf0b3.tmp
Size 381B
SHA256 5b1a2ab960d54e0dc03955f8505ed10d83d0ce55048d362ec080933de6cf48bf
MD5 bf34c19b5e99f8843564d17c9923eb42
SHA1 4cc28073243fc802aa83a33a66d3b27d6cbc614f
SHA512 f2b6f6e609501766caa11d4d55a131f92bedbb6537878ed7e23fba1c9707c6a327e7d06d480337403c09064792ac3300e7c791f4d916ebd0d92f89fc6cca1e69
TLSH
T1B3E0C0612D5C1B438BC30570893EFA75B34C568451A617C277141E404901A841CF9F7D
MD5 SHA1 SHA512 TLSH

Submit Download

ebdd1da5-3daf-43b5-904a-96f8c34d33bb.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\ebdd1da5-3daf-43b5-904a-96f8c34d33bb.tmp
Size 381B
SHA256 bfd67cb1cedbea1039adc1f9ae9e1df2bf4ae2b616a2a85fa8075419de88458d
MD5 36917ba6370fabacbb6eb9c8c5f6fb01
SHA1 2722bf8b757680a0522be9e074d7bbfb10bf95df
SHA512 f488aeb35fb89ce04afd4b3e795b2b241d51b1be856c73e08d3d6239f2a172bdde566b8778fa4f6fbd525fc35e3aac2db83184e8d44da07954287d3bc00e21e6
TLSH
T196E0F11F5450ABE6054417CEC6821595FC1596AC5607744CA8B00F881508A066085494
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 1KB
SHA256 dfa6b21354050d37671e7b0a40cd1ebfe70f6724b41373844a50c87527679d83
MD5 1d0b0b0659c2e7e4c51a9e0b1550a4e4
SHA1 4c5031cfe9dd83bbb0e56b7af27a3b75f55f5e47
SHA512 c56b13baad27064db154fbe1779b935510bd5f09f0a3474b7c136d0601b7a34b11629820398ed8cb3171846617e7688f796b0cdc9b77ff2920070d5ed63261dc
TLSH
T1B931C71E89CE9E660BB6041493FF3EC6D5B42E2317070B5D3357A73051A631AD4973E5
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 1KB
SHA256 c97d4212e655617045a9e22ae66308dd81ab7100b69afc3847a594940ddb353b
MD5 b86bd095c3f51f9db49d35f1e0dcbdd5
SHA1 8425c4d6de520525bcfda90be4b16d510a536e73
SHA512 bc80532eb8f87e50fb4d1353f0ca30cc7b17d5e766557e78b5b5af298565abbbe21a49528599e3bed97173ac074496cacff141a76b1033bf12cf74b11c53596c
TLSH
T1DC21676D3741F6226DB49A2221756C4C7E97619DEB9B4701CA8135075A65B6C0071057
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 493B
SHA256 9ad63acf2df8064a9b0195500f4d39bf8280f5e42364e17d9ff302208f3a9808
MD5 3838fe57e42f0b8f9dba1917113e8465
SHA1 b68b61fc7d0d37d6b660a27b8d8c261758c90f5c
SHA512 2045ab6add24bae7075d14907b592d0abc44194fbaabbc4e959d321a8f22601f9ff199655bd73e526f64b0b363d091bd905897acdef71a3b43010139b964912f
TLSH
T1DDF00E21FC0AD1DF549A34221F326D109A286727CC9391424CDA34052E066494CA6E03
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 605B
SHA256 94a46ac44c736bad014acdb63591b13662eaeef56103e508e52ae3a78cc483c5
MD5 57ab9b913c9cc07b7b7e22689b848901
SHA1 9cca63a49f1aeddad7473b38341e4518e0302848
SHA512 825d00807e5f12a580709c9ebd9690dd2f0dd9c00cf4f3ab0e5fb33ba336ff9ae8bd06aa2b878d63f4aedce3195fdbf945ca0faf9bcb660b0a250bcfba3bbab9
TLSH
T1B5F002125550322BA08A2FA8F23D10D25D44EBA79306AAC05B19608A10C3B2D6A15F42
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 765B
SHA256 c80aeae0ee510f7b3a08546763bc77c72e8280c4c3da78af568c7539d3e469c9
MD5 b32e0b709d745804838e92bf945343dd
SHA1 f95775c83fb7c41296b5c51cefe7b1dffba89d62
SHA512 4167b7c24ec5c4dc166196ecad5c9d8732ffd36505a459453e9ef99961d1d8ac2c484a8556f1b1fc5cdf10757072fa6fc47e55f5a55362a281b69fc3e7d4ab49
TLSH
T13101B5C2FBABA3D8E73874AE5ECD92C062127707CD5105DBC401C79889A06736B8427B
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 781B
SHA256 b9d9809e41dee9ca7bf004783e8ebb6ac9088219a80585c59187efb38d55367a
MD5 e8f0002f91261ea178341b4601987acc
SHA1 5ba9d9326119db992a5c11e8941c46c729272ca5
SHA512 c058d6dddf5e20b37cc87605a3a6fb2d78548ed6ad4ffd4d60b162459cd368945cac8dc4b5bdf1abd05385a4c065c3cc7786ba8f9c894d2552d42bb5a55966bc
TLSH
T16D0141DE5EC94F631B68E243B1AA2C041242C84E7A5CCB45AA1D2E05B0CA99439577E0
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 781B
SHA256 41bb5794fd2886eed9ad315983f7c3e3f067a2e469df4a2f470daa15095e9c41
MD5 beb266597ca56f4a23db7cb528a15a31
SHA1 edfdf14ccb804764cc570cf04254f79cc5d2a9a0
SHA512 e194569f5e9f74544022427d8014eeb98717f6b152ef5a4a3e83c4a45dde3d0b6c287590ae0f71ffd34e2d6b9c54ab6d698a8a5dbf9fb7593452431add1f2b86
TLSH
T1EA01C5225919DA4B3980B6A6409E011AD3586310BBF4739EEEB15E0248F03016EC2B39
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 957B
SHA256 6f0eacccaf64d0931ae89bb6b100b053787a7f3840b3c6e86262b567c964d184
MD5 34377fb2cf9dbf0107485206eac11a91
SHA1 829e69e3f333db8a7640700c6c560cf4923ae938
SHA512 3cc0c32b86ad1cc45d367fe919f565333d268309a7b381bb23cf3e0931d9ec0e3ab92cfb0665044e11d7ce93c2642480c5a7df151cdc5bc17b316ca42e1b82ea
TLSH
T15011C895C0A9390357E92E2394F37C43B92FDD7C242F869A53AB5358A1101A2DD71EC6
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 1KB
SHA256 ecee98e56e7a716fefb9f2edbebf62b9b7b603070904582dbb9a06cfff96950d
MD5 c74c5babda8bf5dc019c25ca6ba5f0fc
SHA1 0b6aae081ab5d5b6ddd1eff313c89531ce94d324
SHA512 dc97cd8a69a42f65487706f8efb61aca13420c136259f1fa3bbc72f0e530efded3b4afb69057360edec5c066d4bf70cea1bfe51823c96205b972a9ab0f279672
TLSH
T1D621E9B4D4027BCEE949C5798101A24C1391379469CCFCEFEAC5AF1605D41913E73E01
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 1KB
SHA256 90b37201e9f6c3d38371e779c068ac12856b37b883ef37d4c93c1ae312940546
MD5 e0fd87baab563a7c4c82bb1041f51a0a
SHA1 ab8e042168c555faafcb807c3757b78e1d871134
SHA512 bff3bae5ea394ddd868ba2aa669ad302d85e93a0438ee5ed1cfc2e9f5e2ab0b4a24e4e54f511f35ccf75f1b74ad163a341e8f55dbf47d8fe75e7af0e8eea82cb
TLSH
T12C21E719AD2B33CD54C08632A48A7401076FEE4AD2EAB276241021FB200E0CED780DAE
MD5 SHA1 SHA512 TLSH

Submit Download

session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_75b31eff-4faa-4117-a8bf-762c68f2dec6.raw
Size 1KB
SHA256 fad1d8380c2c35d215ade79da7f6eacf81fd1b64319c75d14fce10bec0ce5d91
MD5 e7c208aa43c0dffacb7a5e8e9a91b4ab
SHA1 ca6e46f16c8142d9e3001a1222afc87366ca6939
SHA512 9cf3d2a36cf7647c5c69316ff358b0b60c9d2ea3c6a0f393ef9eb03c8f63e375f5421b66705dc4df51bdaca07621c2ee2757f9befdbb1c983e832c643726b126
TLSH
T15721EA8F6E44C61748BD97C8CB7163E4516921D67111119FFD86D292A23F465C761101
MD5 SHA1 SHA512 TLSH

Submit Download