20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260822-e3knyaeb58
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
34	2776	installer.exe
15	4572	OperaInstaller.exe

Checks computer location settings 2 TTPs 23 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	OperaInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	opera.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
3012	OpInst.exe
2776	installer.exe
2896	installer.exe
2612	installer.exe
1276	installer.exe
3356	installer.exe
1456	Assistant_130.0.5847.41_Setup.exe_sfx.exe
2168	assistant_installer.exe
1996	assistant_installer.exe
4804	installer.exe
2644	installer.exe
2656	opera.exe
2032	opera_crashreporter.exe
1588	opera.exe
2056	opera.exe
1068	opera.exe
4220	opera.exe
1536	opera.exe
5388	opera.exe
5428	opera.exe
5572	opera.exe
5708	opera.exe
5828	opera.exe
6032	opera_crashreporter.exe
1848	opera.exe
5964	opera.exe
5988	opera_crashreporter.exe
5184	opera.exe
3976	opera.exe
4832	opera.exe
5152	opera.exe
5256	opera.exe
5292	opera.exe
5564	opera.exe
5860	opera.exe
4972	opera.exe
5872	opera.exe
1848	opera_crashreporter.exe
5928	opera.exe
2856	opera.exe
4624	opera.exe
896	opera.exe
5456	opera.exe
5504	opera.exe
5488	opera.exe
5360	opera.exe
5376	opera.exe
752	opera.exe
1592	opera.exe
4316	opera_gx_splash.exe
364	opera.exe
5256	opera.exe
4896	opera.exe
5144	opera.exe
2024	opera.exe
3300	opera.exe
4776	opera.exe
5236	opera.exe
6724	opera.exe
6732	opera.exe
6744	opera.exe
6752	opera.exe
6772	opera.exe
6784	opera.exe

Loads dropped DLL 64 IoCs

pid	Process
2168	assistant_installer.exe
2168	assistant_installer.exe
1996	assistant_installer.exe
1996	assistant_installer.exe
2656	opera.exe
2656	opera.exe
1588	opera.exe
1588	opera.exe
1588	opera.exe
2056	opera.exe
2056	opera.exe
1588	opera.exe
1588	opera.exe
1068	opera.exe
1068	opera.exe
4220	opera.exe
1536	opera.exe
4220	opera.exe
1536	opera.exe
5388	opera.exe
5388	opera.exe
5428	opera.exe
5428	opera.exe
5572	opera.exe
5572	opera.exe
5708	opera.exe
5708	opera.exe
5828	opera.exe
5828	opera.exe
1848	opera.exe
1848	opera.exe
5964	opera.exe
5964	opera.exe
5184	opera.exe
5184	opera.exe
3976	opera.exe
3976	opera.exe
4832	opera.exe
4832	opera.exe
3976	opera.exe
3976	opera.exe
3976	opera.exe
5152	opera.exe
5152	opera.exe
5256	opera.exe
5256	opera.exe
5292	opera.exe
5292	opera.exe
5564	opera.exe
5564	opera.exe
5860	opera.exe
5860	opera.exe
4972	opera.exe
4972	opera.exe
5872	opera.exe
5872	opera.exe
5928	opera.exe
5928	opera.exe
2856	opera.exe
2856	opera.exe
4624	opera.exe
4624	opera.exe
2856	opera.exe
2856	opera.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" --autostart"	opera.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\scoped_dir2656_506529541\opera-one.jpg	opera.exe
File created	C:\Program Files\scoped_dir2656_723949734\persona.ini	opera.exe
File created	C:\Program Files\scoped_dir5964_1969516457\opera-one-dark.jpg	opera.exe
File created	C:\Program Files\scoped_dir5872_1367503922\opera-one.jpg	opera.exe
File created	C:\Program Files\scoped_dir5872_472368736\opera-one-dark.jpg	opera.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5872_1530919202\_platform_specific\win_x64\widevinecdm.dll.sig	opera.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5872_1530919202\_platform_specific\win_x64\widevinecdm.dll	opera.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5872_1530919202\_metadata\verified_contents.json	opera.exe
File created	C:\Program Files\scoped_dir5964_1342121614\persona.ini	opera.exe
File created	C:\Program Files\scoped_dir5872_1367503922\persona.ini	opera.exe
File created	C:\Program Files\scoped_dir2656_723949734\opera-one-dark.jpg	opera.exe
File created	C:\Program Files\scoped_dir5964_1969516457\persona.ini	opera.exe
File created	C:\Program Files\scoped_dir2656_506529541\persona.ini	opera.exe
File created	C:\Program Files\scoped_dir5964_1342121614\opera-one.jpg	opera.exe
File created	C:\Program Files\scoped_dir5872_472368736\persona.ini	opera.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5872_1530919202\LICENSE	opera.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5872_1530919202\manifest.json	opera.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2056	opera.exe
5184	opera.exe
5928	opera.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	opera.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera_autoupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera_autoupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.opdownload\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.shtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.xht	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.xht\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.xhtml\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.xhtml\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\opera.exe	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\opera.exe\shell\open\command	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.xht\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe,0"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" -noautoupdate -- \"%1\""	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\Application\	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\Topic\	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\FriendlyTypeName = "Opera Web Document"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\command	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\opera.exe\shell	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\135.0.5973.41\\notification_helper.exe"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\	opera.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\DefaultIcon	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\Application	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\Application\	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\Topic\	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.opdownload	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe,0"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" -noautoupdate -- \"%1\""	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.opdownload\OpenWithProgIDs	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.pdf\OpenWithProgids\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\135.0.5973.41\\notification_helper.exe\""	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{32B55841-9A67-4943-A569-B265B4663E8F}	opera_gx_splash.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.shtml	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\FriendlyTypeName = "Opera Web Document"	opera.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\URL Protocol	opera.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\shell\open\ddeexec\Topic	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.htm\OpenWithProgids\OperaStable = "0"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.html\OpenWithProgids\OperaStable = "0"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.shtml\OpenWithProgIDs\OperaStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.xhtml	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\opera.exe\shell\open	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\opera.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe\" \"%1\""	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\OperaStable\URL Protocol	installer.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5872	opera.exe
5872	opera.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2656	opera.exe
2656	opera.exe
2656	opera.exe
5964	opera.exe
5964	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe
5872	opera.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2656	opera.exe
Token: SeCreatePagefilePrivilege	2656	opera.exe
Token: SeShutdownPrivilege	2656	opera.exe
Token: SeCreatePagefilePrivilege	2656	opera.exe
Token: SeShutdownPrivilege	5964	opera.exe
Token: SeCreatePagefilePrivilege	5964	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	4316	opera_gx_splash.exe
Token: SeCreatePagefilePrivilege	4316	opera_gx_splash.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe
Token: SeShutdownPrivilege	5872	opera.exe
Token: SeCreatePagefilePrivilege	5872	opera.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4804	installer.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
3996	DllHost.exe
3996	DllHost.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe
4804	installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3012	4572	OperaInstaller.exe	85
PID 3012 wrote to memory of 2776	3012	OpInst.exe	87
PID 2776 wrote to memory of 2896	2776	installer.exe	88
PID 2776 wrote to memory of 2612	2776	installer.exe	89
PID 2776 wrote to memory of 1276	2776	installer.exe	90
PID 1276 wrote to memory of 3356	1276	installer.exe	91
PID 2776 wrote to memory of 1456	2776	installer.exe	93
PID 2776 wrote to memory of 2168	2776	installer.exe	94
PID 2168 wrote to memory of 1996	2168	assistant_installer.exe	95
PID 1276 wrote to memory of 4804	1276	installer.exe	105
PID 4804 wrote to memory of 2644	4804	installer.exe	106
PID 4804 wrote to memory of 2656	4804	installer.exe	110
PID 2656 wrote to memory of 2032	2656	opera.exe	111
PID 2656 wrote to memory of 1588	2656	opera.exe	112
PID 2656 wrote to memory of 2056	2656	opera.exe	113
PID 2656 wrote to memory of 1068	2656	opera.exe	114
PID 2656 wrote to memory of 4220	2656	opera.exe	115
PID 2656 wrote to memory of 1536	2656	opera.exe	116
PID 2656 wrote to memory of 5388	2656	opera.exe	118
PID 2656 wrote to memory of 5428	2656	opera.exe	119
PID 2656 wrote to memory of 5572	2656	opera.exe	120
PID 2656 wrote to memory of 5708	2656	opera.exe	121
PID 5828 wrote to memory of 6032	5828	opera.exe	123
PID 2656 wrote to memory of 1848	2656	opera.exe	137
PID 4804 wrote to memory of 5964	4804	installer.exe	125
PID 5964 wrote to memory of 5988	5964	opera.exe	126
PID 5964 wrote to memory of 5184	5964	opera.exe	127
PID 5964 wrote to memory of 3976	5964	opera.exe	128
PID 5964 wrote to memory of 4832	5964	opera.exe	129
PID 5964 wrote to memory of 5152	5964	opera.exe	130
PID 5964 wrote to memory of 5256	5964	opera.exe	153
PID 5964 wrote to memory of 5292	5964	opera.exe	132
PID 5964 wrote to memory of 5564	5964	opera.exe	133
PID 5964 wrote to memory of 5860	5964	opera.exe	134
PID 5964 wrote to memory of 4972	5964	opera.exe	135
PID 4804 wrote to memory of 5872	4804	installer.exe	136
PID 5872 wrote to memory of 1848	5872	opera.exe	137
PID 5872 wrote to memory of 5928	5872	opera.exe	138
PID 5872 wrote to memory of 2856	5872	opera.exe	139
PID 5872 wrote to memory of 4624	5872	opera.exe	140
PID 5872 wrote to memory of 896	5872	opera.exe	141
PID 5872 wrote to memory of 5456	5872	opera.exe	142
PID 5872 wrote to memory of 5360	5872	opera.exe	143
PID 5872 wrote to memory of 5376	5872	opera.exe	144
PID 5872 wrote to memory of 752	5872	opera.exe	145
PID 5872 wrote to memory of 5504	5872	opera.exe	146
PID 5872 wrote to memory of 5488	5872	opera.exe	147
PID 5872 wrote to memory of 1592	5872	opera.exe	148
PID 5872 wrote to memory of 4316	5872	opera.exe	150
PID 5872 wrote to memory of 364	5872	opera.exe	152
PID 5872 wrote to memory of 5256	5872	opera.exe	153
PID 5872 wrote to memory of 4896	5872	opera.exe	154
PID 5872 wrote to memory of 5144	5872	opera.exe	155
PID 5872 wrote to memory of 2024	5872	opera.exe	156
PID 5872 wrote to memory of 3300	5872	opera.exe	157
PID 5872 wrote to memory of 4776	5872	opera.exe	158
PID 5872 wrote to memory of 5236	5872	opera.exe	159
PID 5872 wrote to memory of 6724	5872	opera.exe	160
PID 5872 wrote to memory of 6732	5872	opera.exe	161
PID 5872 wrote to memory of 6744	5872	opera.exe	162
PID 5872 wrote to memory of 6752	5872	opera.exe	163
PID 5872 wrote to memory of 6772	5872	opera.exe	164
PID 5872 wrote to memory of 6784	5872	opera.exe	165
PID 5872 wrote to memory of 6792	5872	opera.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=MGU1OTFiZmI1MzU5MTNhNWU5YmUxMzAxNTVjODBjNGQ2ODI2MmM1MDExNDZhMGQ3ZDE4ZGVjMTBmMDRhYTQ2OTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NzM3Mjg4NC4wOTgxIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiZGE1NDA0OWMtNTAzYS00NzQzLWI3MzktZWI5YzZhNDllYmUyIn0=
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6d7bbe608,0x7ff6d7bbe618,0x7ff6d7bbe628
      4⤵
      Executes dropped EXE
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2776 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_20260822052807" --session-guid=7b853ec8-8b36-466f-8b10-cdb9850945e6 --server-tracking-blob=ODA2OGI5NGI4MDRmZWJiZGIwNWNmMmI2OTNmNmNhZDZjYTk3YTc4Y2E0NWNlNmY0ZjRmZDU0MGUyMGE4MzI1MTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg3MzcyODg0LjA5ODEiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJkYTU0MDQ5Yy01MDNhLTQ3NDMtYjczOS1lYjljNmE0OWViZTIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6C08000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x288,0x28c,0x29c,0x264,0x2a0,0x7ff6d7bbe608,0x7ff6d7bbe618,0x7ff6d7bbe628
        5⤵
        Executes dropped EXE
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe" --backend --initial-pid=2776 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071" --session-guid=7b853ec8-8b36-466f-8b10-cdb9850945e6 --server-tracking-blob=ODA2OGI5NGI4MDRmZWJiZGIwNWNmMmI2OTNmNmNhZDZjYTk3YTc4Y2E0NWNlNmY0ZjRmZDU0MGUyMGE4MzI1MTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg3MzcyODg0LjA5ODEiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJkYTU0MDQ5Yy01MDNhLTQ3NDMtYjczOS1lYjljNmE0OWViZTIifQ== --silent --desktopshortcut=1 --install-subfolder=135.0.5973.41
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff706d5e608,0x7ff706d5e618,0x7ff706d5e628
        6⤵
        Executes dropped EXE
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\de932af914ba00303d4a2778a383ac9c831101e2.crx"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ffa190514f0,0x7ffa19051500,0x7ffa19051510
        7⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1460,i,11567966732310332554,15279134256432406723,262144 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1852 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2212,i,7989634643555919894,16892200720290314878,524288 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2216 /prefetch:3
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        Enumerates system info in registry
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2476,i,17804612536064369384,10043800450541010449,524288 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2484 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3520,i,6465013953181789195,8419840157658532883,2097152 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3572 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3528,i,9695948214062923678,5319649477426041539,2097152 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=2508 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4496,i,16074919264733653006,7470125526187872097,524288 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4528 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4648,i,6631166934560339449,6198388815447241688,2097152 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4616 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4632,i,13950683569387304848,8806851178081818365,524288 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4824 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4628,i,16234759035764371135,18288693812087728397,524288 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4672 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4668,i,8431590972925660757,6943454038727019763,524288 --field-trial-handle=1856,i,17415005116869605504,1607891506642789228,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1872,i,3809103473297989326,9013925883187402397,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5080 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\additional_file2.tmp"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ffa190514f0,0x7ffa19051500,0x7ffa19051510
        7⤵
        Executes dropped EXE
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1852,i,980902309672839463,8701843742112603914,524288 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2132 /prefetch:3
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        Enumerates system info in registry
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1664,i,3341217900265463060,1022453524340408107,262144 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2096 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2500,i,4721991398821149469,12960223614395682211,524288 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2668 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3796,i,17084346322205031650,6984889155057964452,524288 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3940 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3964,i,984265708990736789,2749447225841101230,2097152 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3952 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4492,i,10454509185684155552,9944572706230539473,2097152 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4552 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4460,i,16096484726987227192,1723064201366505792,524288 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4516 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3820,i,5998998704730247579,2356907083764827270,524288 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4760 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4532,i,437989731658705198,10514537031207439157,524288 --field-trial-handle=2100,i,12256692137699812356,16866566544802440262,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2104,i,8641620077143829269,10484645711426129761,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4752 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x238,0x23c,0x240,0x230,0x244,0x7ffa190514f0,0x7ffa19051500,0x7ffa19051510
        7⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1904,i,2018537134457724441,9856025920419384464,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2136 /prefetch:3
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        Enumerates system info in registry
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1696,i,6792783618890520873,6700978880101139716,262144 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2012 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2480,i,11666210951121002103,3424539742432284110,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2400 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3324,i,5682480667733901730,4602716828622055776,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3424 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3336,i,18215416336234540940,14683896062320005578,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3444 /prefetch:8
        7⤵
        Executes dropped EXE
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3300,i,742194802083116188,11165969228697282976,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3380 /prefetch:8
        7⤵
        Executes dropped EXE
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3312,i,10961608144582388078,5585881394393015338,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3404 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3348,i,9654487642834792208,3391028071797848901,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3464 /prefetch:8
        7⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3360,i,11801839721351452170,7027057055946722821,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3416 /prefetch:8
        7⤵
        Executes dropped EXE
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3372,i,13724372368549798270,8575768799937696224,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3508 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3784,i,15847516231892827389,8876306436841692889,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4208 /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_gx_splash.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C96
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4656,i,15095973358407390088,11282583375133068263,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4660 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4820,i,3347067121197566362,4880306859764317105,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4832 /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5028,i,10707563075745956805,2849305673156551085,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5040 /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5180,i,17030298576478571216,17792620536918722708,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5196 /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5608,i,14306423194319580418,16222942164510155820,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6088 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6440,i,15963559758733905458,4694145794296114144,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6560 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6720,i,8874927216555587255,7647118096684467168,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6368 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6880,i,4017132542346634465,9847869720485582188,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6860 /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6788,i,9764095181613601283,17788162448197801371,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6896 /prefetch:2
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6864,i,6537814877930177951,5383445595947082344,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7056 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6932,i,3544432210956054400,13262497352724049,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7076 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7044,i,12178943535699040163,14513376233892435197,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7116 /prefetch:8
        7⤵
        Executes dropped EXE
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7540,i,14737183740093434127,3672870672988985724,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7548 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7556,i,4638828621020635143,12510739994648368342,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7592 /prefetch:8
        7⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7552,i,6921970235236124213,4989401196092452720,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7732 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7744,i,12311861015865553632,18332405421561299994,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7956 /prefetch:8
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8152,i,9691389805947553020,1417126324561559595,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8168 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8188,i,7309444935573798472,2722702720579382628,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8264 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6536,i,3182145083797454116,1651343365208186992,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8284 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8240,i,1534993886008677858,5619699728883692718,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8324 /prefetch:8
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8232,i,6646303408867669534,15881946677849979397,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8304 /prefetch:8
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8916,i,14492677321380106841,16477258025086005138,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8908 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8912,i,12589406232301613787,15859944652343045379,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8776 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8932,i,9714754141106738915,11837918198640244640,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9168 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9176,i,18283317535870977492,14640633198031902666,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9308 /prefetch:8
        7⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6936,i,12476911121070924759,4303258463000822047,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=6832 /prefetch:8
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9536,i,7424619925525451619,13948998394114109499,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9616 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
        7⤵
        Enumerates system info in registry
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6a7c6c278,0x7ff6a7c6c288,0x7ff6a7c6c298
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10080,i,9188518180490335757,1897078623805082328,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=7552 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7864,i,8452352744842787872,5229451378127742022,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=7852 /prefetch:1
        7⤵
        Checks computer location settings
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10420,i,2261389914133652259,7897469259218626704,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10432 /prefetch:8
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10564,i,5944004501462446898,14777864060527740058,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10576 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10708,i,11802085493673816718,6718867349268653975,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10720 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe" --fix-taskbar-pins
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff706d5e608,0x7ff706d5e618,0x7ff706d5e628
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10932,i,9183686062355518333,4954098402651937184,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=8540 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6068,i,7553050209079234043,2269967499959373406,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=5992 /prefetch:8
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9612,i,5592660542813527983,8788880369612927538,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=8552 /prefetch:8
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9664,i,11120600954375122002,8214006848848213169,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=9592 /prefetch:8
        7⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10144,i,17200210988400296889,12801315012252294904,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=9540 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10088,i,6574624306239794166,10842255523349144013,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=10164 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6940,i,7583249223337660097,11215675116637063463,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7560 /prefetch:8
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=11176,i,4046798410098644791,13469500716469816873,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=9180 /prefetch:2
        7⤵
        Checks computer location settings
        Enumerates system info in registry
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9188,i,754641548541975581,11396536987268624592,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=11204 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=11172,i,2463983192612129365,8116057677241604116,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=9072 /prefetch:2
        7⤵
        Checks computer location settings
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=8924,i,5159378454681608082,15824714434658578149,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=8396 /prefetch:2
        7⤵
        Checks computer location settings
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=9272,i,7051867637179373159,15454341447366485914,2097152 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=9260 /prefetch:2
        7⤵
        Checks computer location settings
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:ai-tab-management=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:player-service-html-promo-banner=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sharing-point=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9408,i,4466298189370230949,7258959160778532972,524288 --field-trial-handle=2016,i,15287084916367993983,13398768070675036202,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2020,i,3728269511682055819,15080420782890475614,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=9264 /prefetch:8
        7⤵
        Enumerates system info in registry
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x1264040,0x126404c,0x1264058
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1996

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3996

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe
  C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x234,0x238,0x23c,0x230,0x240,0x7ffa190514f0,0x7ffa19051500,0x7ffa19051510
  2⤵
  - Executes dropped EXE
  PID:6032

C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC1
1⤵
PID:7124
- C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
  C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6a7c6c278,0x7ff6a7c6c288,0x7ff6a7c6c298
  2⤵
  PID:5284
- C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
  2⤵
  PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5872_1530919202\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

opera-one.jpg

Path C:\Program Files\scoped_dir5872_1367503922\opera-one.jpg
Size 194KB
SHA256 2e8375c8ba1c0f5379de54bf4bcb0af7ae0ef3c2a6af07409c8d007ff0685b71
MD5 c18898ca5a97bc5807f3be336fb1338c
SHA1 83fbeaa1c4a4b69599cc6eb08f8958a6908f6b32
SHA512 f7163299688c9fdaae8882c38e5992cd23d90f48a6d36a307e756794c6c0541afbebf12b584c2e03464008e2e4927e775e57e3f982e412206b7d9db271976a93
SSDEEP 6144:bcztf14vie9cI/+1YhN8iuRIHN2XT7/N7:bcpfmiscK+QReT7/N7
TLSH
T10014125012852B6BD4DE763021AF362DC703F5BEC63E94065180AC5BD9CBC931EE7BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persona.ini

Path C:\Program Files\scoped_dir5872_1367503922\persona.ini
Size 207B
SHA256 7cd803353a8af5af891ddf63908e408d1667cfc4b4d2882c61a0fe734df919ec
MD5 a2294db65c800d2e518ec4943a2dd187
SHA1 02e293150a096b6342d1c39ab57b27d5c0c8cd7a
SHA512 115c2d5573795136eaf70cd9c89478d3b1c4dd95aa7189cfdf59319cbafc7f90a01e57c34050bfb24095bada13db3bae26515a1d4c2479f646ae52851dc41f53
TLSH
T19BD022A621820222D203C79C207173CE9AA692588A1442AC03EA70A3F21B2A9C297D60
MD5 SHA1 SHA512 TLSH

Submit Download

opera-one-dark.jpg

Path C:\Program Files\scoped_dir5872_472368736\opera-one-dark.jpg
Size 349KB
SHA256 70b35d024405f6adfb37715e58cadeefab36e305158a73e8a4cc377bae1a4476
MD5 fc3dafe25d5bc30a830ab92aefe52634
SHA1 2e1bda9bebb1539aadf6a2c6ca33c3b9ac8865fc
SHA512 d9ec9ad58ef765de7fb1cf737e9d287453005edbb5c47524e19938161c14b16b59084e9b91a2b40389c43fe9204fb9fd41698aee68968fb2fb046a4cbeb73829
SSDEEP 6144:SXn5tlDpMtckM8FeR5HrNVvuxQiW3qp6gIQ7B/7SoK2RIFW8aE6mM+z:QnfMtc/RBrr0QiWc6TQ7B/7SoK2REafC
TLSH
T1A0742397ED4262D66B26D0F13C52692FE3066AF31728454B322424F7B3A1C1AD1FBD78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persona.ini

Path C:\Program Files\scoped_dir5872_472368736\persona.ini
Size 217B
SHA256 69feb09a5aa11d2badb4cdf17c2ddf7861a97a1d3a6add0ded22e5e9e07defc5
MD5 8fc4f4bf76a946d682606a6be94a822d
SHA1 3248c1d836e9eab63f0b647ed3249af2dc0e342f
SHA512 5301c9918ed28c51ffa1d06796f897d7d7df3954a339718647aff9d11c7c96fb27fe1cb0fc7438c5ae1e86cc9a7322fea7b41b646ae03a4d51f70aa4bef6f488
TLSH
T14CD0235211470321D103D7D920717ACD56B65168C604539C03EA7093F2472559592D50
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 62e451cd6fdd5d286f0bc295706c54b95759cc99fc00977248cb156932a32abc
MD5 180f6d9d48f38f69050e31145d31e080
SHA1 88f9e8a2aa6c1502e9c01245be5227ea86385f37
SHA512 0302625c3112af24da0c99a51af81fcc7f2f1f881405cbe824785deb9ab4f352c8cbf8cd50613bfa82291d3198d87602cc198cb8773ee1fc4c6587be06cd5641
TLSH
T15BF05C92A1BCE9230F4DC9EC45E50A3A7516507F04960748612C09E5C7CD6B5AF2503E
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 d77dd8e1fe58c9b5dd351508dc2cf1dfb9ffd67e724f72ab55cb7da81d83a778
MD5 3a536d3ff573fd60fd2bf5a8436e7920
SHA1 9ef34551f131c4c7f29959f9f56104f74e78d4ab
SHA512 074f37fb3b1161122840e3dced7d2cc326cf813009ac518b9ffa2af2dcd4cab679ce0e348306f196767f0d8a4659532ffa366936fee2456ac06bbaab203919c6
TLSH
T1ACE0C03415FB006DF5F4D0B84FD9F6310D56F032441CE2B21AE02708BB17900BE22A35
MD5 SHA1 SHA512 TLSH

Submit Download

135.0.5973.41.manifest

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\135.0.5973.41.manifest
Size 225B
SHA256 aa5a1ed3b99720eb5d204aaa125842b8b3c309b0b8ca8c5e24ffbbcd4604da31
MD5 2645ec47a969404b6a94a216658640f4
SHA1 f5191612e9b9bf00b5a30e658526c1a97537b4c6
SHA512 e4e92aca2b030043947fbc32a3f3ff54ff4faef1c042951405d4e3ffb36776b9ace1f48c3295d972419c405b4ec4981a6fc50d20b2e78fe52d02a57b98daa6e7
TLSH
T110D0A922CA8522097B3141203CAA20054918C7AB048AA24870FC7C67EFA3928A1828B2
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-100.png
Size 1KB
SHA256 56bcd46dcfae3147a8b8b3d00ee5041dad4655e83a7e829bf637377c96538643
MD5 f4d70bc86e8544d7758742c2eba89d47
SHA1 5df4635794ab25e2f88bcf8ec39c19a09383a029
SHA512 d20cbd543bf97890d64c07f9e99188604f4dc5def904ad74229a3b1d9d9a06fff93af711c99a178799e9de472d930aa52a0c154f0d2953abe5ffc3cfd1708ab9
TLSH
T11811C840D668A4ECCCCD5DBAB2BC3893D7529C198049B1DB4CE1E8E38C303050976E0E
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-100_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-100_contrast-white.png
Size 1KB
SHA256 3829dbefe8bd528be268f3181a902e1fe78883eb8f8aac679c9985c2ad13c6b9
MD5 7f69f89f11fd675b36e8de01de3c29ad
SHA1 b91e00e68889367de138ffa5e7fb3c9de2a18467
SHA512 06c162296c5ac62429e6e5dec07b836e6053cb4eb0291d8ed904f71cc42352c134870ed964517d2600f03fd7cf3821ee877ea83a330c9597fd7d629f9c2a6432
TLSH
T1081184F6422D2D1DF58532B16EE55FE299A82B2535D0BA425008C1194E2B512C900180
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-140.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-140.png
Size 1KB
SHA256 2637072751e1e6398c45d2c5b22c54adadfbbd4d3007238799f5da63f846167b
MD5 a0076d9b3db9054267a7c86c9323aea1
SHA1 22b85aeec3e3804fe1f6e91d5a9ac1c6a0153b6c
SHA512 8fb750bddea61501f8ce2b0d0c27d29f322c9f297777f26b1401696c836c844369a9f6890bbb9827682deb70004cd98a973a0742d2d218f12a9fc3c301f10985
TLSH
T10121F84FCC2CE4E4CEDD49323C15A326A33021C950036F8A99CAD3F2876474C68B71D8
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-140_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-140_contrast-white.png
Size 1KB
SHA256 ce3559b2efd6d547fb822440690cfbf793eb70c98154ad4dbf3a7c0e1af5e166
MD5 f601df01a867a51514ea89ac9bfe9b86
SHA1 827cf9859b7b1864236cd1f03e8aa40758285e82
SHA512 2714e67298058e8fdad4459cfa17e2c7c67353bbfd9ea850bb403e669ae085ba579c31f7d64889470a97565719342e6a30efe2f66566783197194433aa947600
TLSH
T1DE21B45BA702048EC2065E3F4D54C81B6591FFAAA3B3DD4B265303B0A44217E18E76B4
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-180.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-180.png
Size 1KB
SHA256 7ca510381079a4b166e9d5fcf0dc005d9606197e8636621b655d6459941139a0
MD5 0a76f51f6169a31402ff7c61cfd05161
SHA1 843a32d6dc0d5b9d97c5f475f96e49852823a103
SHA512 7056949d7aa9cc4c96f9c13d656cfffa9f9a49ca78f6be3037cd38cc1d8712917cc235099f24723bba26fc9ffdba015480309d0418961c1116dbe7b65de6301f
TLSH
T14A31D8C629E310F9F9FC01F501126A6CD7C095D41162215B68CADDB42CB37257BB90A5
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-180_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-180_contrast-white.png
Size 1KB
SHA256 f7eb888cd9bce4641fcb01088b05be242f616dc06c3f823e51fb63b53b6f14f5
MD5 67a0163cd9753e42360222a17173f593
SHA1 e4ee5c2288cbd5d354aad1905b917285a3daeb92
SHA512 87e69e15ba6dee402dbe5a90da864136ec2c6884c204a567ad461e0181e70514f73a7df22a47de63d4829fa937e56fc4c08cb6c5268313f7b9af1e7217d81f47
TLSH
T10F313C6F5D568577E37C42BCBA7085F5D325B31C400727106F34B2983814E5521A89CD
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-80.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-80.png
Size 827B
SHA256 f287370ff8c7e2ba120407cafe09c1fce674ae8af5bd5fcc0c2dd1c6628b9ce9
MD5 95a8f1834d8da00ad94c0cf2aa09853c
SHA1 7e830e3ef55b4d7b9a18ec8c151bebb2c28f0069
SHA512 c89be6e503c26efd4eec12c77e091570e187ff64928cab01f6f873d9ca3769f019a1724f76b57c9d4038495e29cc4106f919082913323af1ece7aff820c828f1
TLSH
T16C0120FB28489DD0CEE79271529CC55D9BC259065A80D0F7D2E9D8C05D33B49E678810
MD5 SHA1 SHA512 TLSH

Submit Download

150x150Logo.scale-80_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\150x150Logo.scale-80_contrast-white.png
Size 799B
SHA256 0a9129bde051c17e96e516d5bc509e1a06a1e066a5e2796627cbef8630002b47
MD5 3015766c5ca769e54009f167550f7389
SHA1 0eff02455a1e0fa1724bb1d4333c3d24329f9e9a
SHA512 7ea7495163e0246f78f88dfd0ee72b8584108c286227d70cec9de125747f21f2618f46f7197f7cb9c0f40d297bcc3582cf70f54ebf7f9eb10941fbaa6bf0149b
TLSH
T17B010AC8D032EEA5D91788F36CA24FD59CEF42F000181B2C84A880913C030D6B03ECA5
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-100.png
Size 781B
SHA256 fb5662c5fde7d49862da2e0253ae03dc7e5f9afd2edc65d4efa6dc3a3026156f
MD5 ef710f4543a25076078fbc1c09ec9e2c
SHA1 e4ea1c2cb24cfff03569dab28877d11f9c6cfc74
SHA512 fc979d06806a69da71336533d96b1cb66b227064a224e23c6f5bf9d1fe4e85a9d9546643ce296ba5f04c025284d5ca2c445c52695aae669735a2a5b48ce07a00
TLSH
T122016002E621E8FADFDE023E322C446D4725035AA706BA1F00C6F8A72EF0B4820B7049
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-100_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-100_contrast-white.png
Size 752B
SHA256 3fa9dfc982544f3ffda0795beec69c65d6c5883be0de37133466e643b5f3aeea
MD5 ae8eecb8db4d20efbd816b887ef75840
SHA1 1d0cc741d0a75e5e8ab51dd8b6a99f5e679ef5db
SHA512 0cb71eb86ab2c5d4c70f04d7b10736aa453d51b56723ed7c9dc332f92ea428eb7861f23da2e30416bea8cc59877ba2c87f3032ea473028a7df8c6a299d517572
TLSH
T13501B5E19CA5D03C9D59ACB03820317AFFBF65062CA02F825474762B2010CB538E50CF
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-140.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-140.png
Size 991B
SHA256 84f8ebb629791e0b73cd53d7f3445d685145d0787a207e25842b237c98a8c99a
MD5 9590b4bd9378a2d8706dcbdc630fae8a
SHA1 751eb2aa5ce4e83133a73fdb9efffc013bf37ec8
SHA512 b2666efa916584c9b090e305eda116f2a90c58862fa36a0963176b09b493a4ce5e601a178c74be0f2e59811ad42cd1d5747e8a45ea07c3f5d52b28e177fa5603
TLSH
T13C118820BE023DEDEAD89D14E139505E86042902332860CBA0E5D4908EBE79044F095D
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-140_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-140_contrast-white.png
Size 865B
SHA256 99cd2b5809ab9c604613b305bc80e6f68b858c1289c07e84aadabc4c3768ff32
MD5 9b103e9dfc26dd4d837df8ab55ec4fb8
SHA1 6f46830a3a63e0eec923bccfad57d8391ac3e559
SHA512 e8023067638a9fb849ac9364a45c8be9a6dd325fbc704d960cf270ce1075ac6c9d57b7f96cae62985e92e5543dc2f2a43d473a2dcb0060af067cd474aab7e59a
TLSH
T103118AFB1644C6ED594F572F50DA9C51734B8A3B836E80189A3C869CD190F44CB77ED1
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-180.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-180.png
Size 1KB
SHA256 c5d33ee3b5e8dcb9e9aeae5f14d0e92cf9bdc16d6245ce65dd4340c8a0be4f26
MD5 7ab03a8ba1c0243b96c4124cd5341073
SHA1 7de490dd37ebed58337fc0db654f12398e84a78a
SHA512 c96846f008e8ab440009bf2442a2cb9db3d24452619c8c2b669395f971f9a316ec62693bb586a94e565f1cab893bf665112c34cc1fa46319e571e3fb4d2fc41d
TLSH
T18021E7612B26DDFBD7C182F1913B4A395E1CD582327461369CC2E1623C3772E1271248
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-180_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-180_contrast-white.png
Size 1KB
SHA256 e5112331e0e2684ffb5adc0ac23324d9836cf067111f1f5834c77b1153a8a5d7
MD5 1521be4b8c8f2e0ce20a89f163de3909
SHA1 c291448b74fc3d7060c1df4b35026084981ee441
SHA512 6a0781d275dbf8fad4ee464e759de74399918abdc99cef3c74e5d66a0d555a8bed363da964c15e2ad9ab3cde5a17d537bbcbadb10585aa1ef50f0b614fc39a50
TLSH
T1E011BB5771622D70C791577F5868F505DC72D33134A18DCB5CDF29ABD0C62B4449C242
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-80.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-80.png
Size 590B
SHA256 91ba72309e34c5336c09b8f5c787a6327082f275d5d7bfe491c5430e67c80752
MD5 1b4ff26a106929e3a5710900a9d984e7
SHA1 d3e1bb4fa64083743ab56ecd89d586df6b583bce
SHA512 d8537fa3b0da1b2ee7c8cfbe9101a7dca624af4532305e06f211e4dac799ae9b533f19d3cdf052352e2a926bfe32cc908cd3944b2543010e7baefe52697add92
TLSH
T11EF0E16019445CD54FED19969A3D4F30EE5034155813BCA70DC2D8369E2634598B260D
MD5 SHA1 SHA512 TLSH

Submit Download

70x70Logo.scale-80_contrast-white.png

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\Assets\70x70Logo.scale-80_contrast-white.png
Size 519B
SHA256 37b0f1fb4a08af8a42e6d8fce4c7380ddae0272150d7a9bb8b1d138066a9ffbe
MD5 169dc90309162bbabf07ac3d954a076f
SHA1 a4c87f029a4f34d66847271cdf8c5e73b1e48a90
SHA512 b7633c8faa5614efb402c47957577dbacca1a1b3fd0bb39cf79eb3a06ec6a55f9b8c5ee9569271efbfd7d43ad348d275c0c6c9faf840663268bca2fbc6c64bb7
TLSH
T1D9F075C360D1ED222EBA2004E411ECFC747A11985B439885003B48BF7F77F20A90B088
MD5 SHA1 SHA512 TLSH

Submit Download

assistant_package

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\assistant_package
Size 3.6MB
SHA256 a22c9d836d9548a8beb6910280be0f908e57e6f6a6d9b197bd27bd77a11c75c2
MD5 d70d869b2c08aba002184c67037e02f2
SHA1 90b865ed1689694e69986bb3bdeccb7e73db7c5a
SHA512 3c531b2ed86de4e1338155ca2961f116cafd685f43b6bb821dadf138427a808188832f01fe64465021fa79e6e811521606ed7e1261b9649abedf17ab1def4a62
SSDEEP 49152:+kinoMg39zotQdCT8TvDIiFnTxFfPcLgVpyKUhDLSB2eZ2X9qqy8uqrfP//0a3yY:+kio9q8TLvpFFfzVkK0neZ2Iv8RP/5Ai
TLSH
T12C063312BD5084B9D12315374DD0F7BCDBBE7AA12A664A9F37841B1EDFB0003A319A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\d3dcompiler_47.dll
Size 4.5MB
SHA256 702f4e90e62d67d6562723c9117ff52c0b36b079bbd037ee7b1c67f26083eeec
MD5 ab11c3c48b88515d46efe17f87f60e05
SHA1 aef7b7eaeff04e413450f13a070d601779a34db8
SHA512 e7211d162a2f40de111206aa70a11f32a032af6137fbaad6031e869f377d1fad5dc62a13d3c25a7b80766f679793d947e187244ca4b87198326e3f71b2f4675e
SSDEEP 49152:U6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/h:UUdeqt737jFm5wJ
TLSH
T182268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\dxcompiler.dll
Size 24.6MB
SHA256 3a4c4320c4ea8bfb8cb092daf3b3706a43d117c867ba06e58b3fa4595efece85
MD5 61e2c3ad3aa80c594dc07d16fc6f14fa
SHA1 ae4e0abda564995af11f41f99cbcbca6ea77cf1a
SHA512 624f9a761cdb05aeda89899a5637e6859b459c402a54451363aad80e5a019b0d5aa6b2271661ccc0b6a53257316c74788084e75314ed5ac0e65c417bb1d32218
SSDEEP 196608:3rK+o3P68zXKB+6Y+wuLEjlcpa6pU4UqvsGFVsxtHXyitHBVLOEP3NNy4ayGflJN:3Gpf6VxnIjw+4BFVsjXVXtP3ffalWK
TLSH
T16F4729122646D49CC099C879C3678B268A6C30E73FA7B9EFC0B451252B79DFC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\dxil.dll
Size 1.5MB
SHA256 8d5ae0f0c94a0a85af621502642cecae338119e81dcd126a6491bb37562e5de1
MD5 2276496bb2de1d0b9125375f8abda82b
SHA1 821aa62f53a6d44c56529b7a174df34882f8c286
SHA512 9131becf34888f6c6f2f4e73250127ae22c368f739eb61135d82ce1c8756d11348414ba0aa917a22ee6c8e0c2098e86cd45f3f79a1531535a3eef309a9738403
SSDEEP 24576:8cuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/K:8sHMPzbOxBduHdSCde8ZF1/0Wy4oV6b3
TLSH
T184657D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\files_list
Size 6KB
SHA256 f4dcf306460892b5da27e01eb19576653afcee96061da32764e25715473928ed
MD5 ae3d02b259652f183bc1138b6bc1c472
SHA1 cb65771e4b662829ea810a7fec2ee33cb920d118
SHA512 bab0c00c796ca069d4f4e58b350cbde798ec7b8c8afc1d2da9816a070f17080e0adc9487d48a54f137be8bb040ad54aa82aaf84fc248356004159a7e1645880d
SSDEEP 96:0MyTfz5XZyITJhGwbx7Vt/JnZ7vMbngEDi1JZJiRORnOU:Rafz5XMRwbxHBZ7unmvgORnOU
TLSH
T107D10697895F0265CAFD93F1EE61F89091342495EEB83058F7C70A5694A33FE02C9ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

headless_command_resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\headless_command_resources.pak
Size 2KB
SHA256 0a1581aac1329ff89452212f69d661c61f11f8fd96fbe4ecac17549fb8fae65e
MD5 3dd81a4a7e4831626d264e5587af846a
SHA1 c4f7a81d7194827abbbdf7fd22d136852eb8fe39
SHA512 dc50ba7e64222e35768925f5fec33c5fafa014cb13307669d77fc45ae6521ad5adf2077ec34bc6a6f002bf45e355a89ef5bc9496f0e35f05b4c51d80786ecab1
TLSH
T10D511893360AB6A6C079C72891DA9A7C6BE58325748DB5744EB70C33E9384A345C2871
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\icudtl.dat
Size 10.4MB
SHA256 f11071c692e85689891070cb6f68120dc1a49941325325f7e5b017af42483e72
MD5 ee759568c6560e1cd42a5bf70d46e28f
SHA1 f81dc21258e99af2f98b91aa8f968e31fe652d1b
SHA512 d41d0626cb131da5628f5e789e09d52a035673f2a31eedcbcb3879b2b65d82113ee52c8c4a03e26b00f7d652a7fce1a06c0c02fceccd16fc8e9116f9c66362e0
SSDEEP 98304:nHcBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndL+j89j:nHcBhORok2HiXUxO/RJk3IWhlYntjd/j
TLSH
T1CEB62803A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer.exe
Size 8.3MB
SHA256 7c684d6eede066a382bd364341c110c80b6049f4362ac26b8910f4ca35d7a4f3
MD5 42c8068cfb336baa6fae4ddab8ad1227
SHA1 04238af1c69102c8f5792fc013f84855eeb78c10
SHA512 6803c57725f6711d64bd6001d736469ffb7f4e8a9950275aec2b163d69b29e9eebd975b390c959a404305debbc8126e2b35f34f5e5c2e5b3a6adfa6d3e838478
SSDEEP 98304:ABqhKn/TZlpgsbVjOIibQHedxKNQYNY8AFA:AYKn/TVdbV6FEQXFA
TLSH
T171967C53F2A601E8D06FCA748B7A523299757C464B30A3DF0A943A251E75FD4AF3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_helper_64.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\installer_helper_64.exe
Size 596KB
SHA256 fbbb937b2128e0bc0d27bb3032bbfa6e0d7c16723ab1e34cc1c6ce12118376d4
MD5 a8802c065e51cc111dc180af768c8959
SHA1 67535238432088b47d88d6f892f5817fd563d431
SHA512 09b5638078543c13402cb8aa3d1cafab7fcebe25b09fb7620633ea844e5815c960606a8e34c38d2d6ff8ed1b9adf42690594300a2e267941a8c7d0561d70322c
SSDEEP 6144:bJVk6SVq2UdrTcct4gxQX/URwxu36O1/V57P6O45upU07+izcn966qm:3kl0rTwX0n7V57P6O4opU0q4cnw6qm
TLSH
T181D49E45B2E547ECD03AC1358A418616EAB17C560F21BAEF02A072792F77AE51F3F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\libEGL.dll
Size 457KB
SHA256 3b881917835f748b790809c4dd82e0a122cbcb08badb1391dc3e804f65c7202a
MD5 a43310f9bdb9108a5fb39406b7115422
SHA1 1cbcd9a44f1ea21803a405e78c667156a1c46bdf
SHA512 7a1ed93c21f3714559fca7cf0a14dd522c1b77082c2649d6e2d265973c7fab97fb3dad812e1404bc703386ca764a38db1b703c8e682239459661f2534d8f17b3
SSDEEP 6144:n+OKyjTntPEVDS+A8/NCW9t6c/6VdxWHE3QX:n+O9TntgWGNCW9t6kkdxWEAX
TLSH
T1D3A48E15B3E948ACD076C1348A538647EB7178960F61E6EF03A0E2792F77BE45A3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\libGLESv2.dll
Size 457KB
SHA256 bb9c7d9ebdf2421364c69649cd6a388ef59fa34adbbddfc615d8f0164bcc6cb1
MD5 67dbac631c812c468e5a915c45602151
SHA1 3bd62e69a38bb301b0974aa7e72976d149758211
SHA512 42f33bdc6d6b005bd1f5fc6118e0287584518f5cdf3de404c90b00cad9f1ab165bf9fd57c653c416f485223e8c7aa56148f08cbfa522c1f56376f9d146c7cb4a
SSDEEP 6144:ZaVDyyrnt3MiDyVA8SNCW1t6vveRGNyRQX4IyWqx:ZaVvrntrmONCW1t6He4NyRlRWM
TLSH
T187A48D05B3E948ACD076D1348A538647EB7178920F71E6EF02A0E2792F77BE45A3D325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\localization\bg.pak
Size 1005KB
SHA256 2cf5258af1511a2668239fa3db5bea2306bd5baaf7dbc818b880c12674dae0e9
MD5 c292bb8c28998ea935449dfaa650cc15
SHA1 9bd2d2edb3c9bf2f2b044957ea1aa09f7857f7c8
SHA512 1b6597d67bcac440df8f6943306164e508cff70cc8d46cc9c32a8592fd9428a24c96041d4ed5275c9842823d0aa7072bdcf4abc1159bccecf6049f578567c56a
SSDEEP 24576:I4wtK+xmzv8b3Jwo1vXS4l9cIHdBBuK026g2Hd2WsZhvYUgCzQkECZUxVb6fKfJW:I4Rl8b9Xd/dBBuK0td2WsZhvYUm+UxVm
TLSH
T1662525A15B9A649F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B887BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\localization\bn.pak
Size 1.3MB
SHA256 2f03be900202d2eb1100e8235a1cc59a5eba12d0279b27ef7c9be2bb3455bd94
MD5 ef34f01fe23a3f1cd46b4a0adcf0cd0e
SHA1 1548545960bc628e4f7a1be91caa0d1556bd886b
SHA512 b1c341a4b17bae793e0cd116a4f90985c3cb381297d94a49908be62ad13af236880d10a6c87b595da142ed2ac14688f199256b9f3387507b20a7356a27a88533
SSDEEP 3072:b/zYv8/ISZ43Du8EfGZJXjWviepLBPfXrH25FQwMS7sgN71U6mZ/u1WOgUPDU:N/ISEDNnKvieJjzwMTgNkZ/n
TLSH
T18E55EF209C6E81B2A8D5CDC9434C6330C123AE979B65F74DDC17A25938ADC3C8DADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\localization\ca.pak
Size 632KB
SHA256 9013232717a21be05445d416b30770f227777c6a0345962d33956c73df6d9f53
MD5 cb58af7ec1ad677cc69f3dd09dfe8086
SHA1 5cd8b68c3ff3cd01f6a1dcdf7ac33304f1d8b298
SHA512 7a29e1c28276e38104bed690fa9da7eeef50387e18e4d05b1d4db7cd63c56adc380a6aad65079098977e5e3c6dc7f56ebea02414b0dee291902f3ba9d66d14fd
SSDEEP 12288:pMnfYo0zY7K6ybGbf1bCCrz+W58rPglpfmbViiG6M6AqHl9kdkcBKMe3aR4Uz1Oc:puaz9SAaGdMLEe6izgtnjaFd
TLSH
T127D4F7238BC83B760493330AFB46C217F09CA9847B16D254F5EE1A5622CCBDCD677A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\localization\cs.pak
Size 631KB
SHA256 6e4c44a15a6bb50b819f5f26c6f68f8409df804fcad91fc5872c123072c271a2
MD5 9eb5975ffd8b2eff111fef3de225f88a
SHA1 a1330c158c2a758739ce05602203438d92d92b53
SHA512 aad5ffa15bbebef49cc19b048cf836b79a6ccab1bf22b7a5b3513fdb24063c6ac1671d93f350d87389dd2edbb6d4c89b941ee951ec2ba4e94b28e3c9c9291156
SSDEEP 6144:PqCbsmQUevgWzHyYHGOXISBzg8QtsMHLG9JCoc31j6MqYfy2cV:VbsmrevPzHyYHGOXISENEV
TLSH
T137D46C1EDB936439584002447FBA5228BD5E83140B6EA9AB3CCF9D912271B7ECFF1D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\localization\da.pak
Size 581KB
SHA256 1f6dbe04e54b3bda1177a29fd1da3e3cbe619e9176f41c7150ca62e08f2fa834
MD5 7cb535ab75a0715f885ef99351d32a4f
SHA1 f85f8b2cbe03b30916780311622c31a5409d923b
SHA512 3d105399213929b62e392c0769f681bc35d57de3e18e6ae40c44a9f1491e74eef1699cc23781e7419e75a561097e92eaa3f194b39f78663d66295594cceff4b2
SSDEEP 6144:DHFa92AtrA0qprNNvfzVWgkyxJxVtsIGMwd4AdCfwgWszZhLCRQgP8oaEd9yOqiL:rFaoj0qpTZkONse4FRQgkXOqSpDdYLU
TLSH
T1B4C45A4BCC9C333F99A90764F6118DABDBAD543CC684664F75D8903A16CBD6092BF2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\localization\de.pak
Size 629KB
SHA256 23ae9668e414f7ea891ddf690386144779a640a55ee395f051ddd43545e7104a
MD5 30cd529fa5ee31f0cf2e5d71a034b5f9
SHA1 e691573bed22af43fbb7f3455b41ef8d35161dc0
SHA512 3d4748806466bcfd65e0c9e9ba175d27a779c92634fbdf4f8c05e540cada23fbdf90a9a529b1f4099cc42d1e297b157e3f48584fdac48bdc9e28a87f3b243929
SSDEEP 6144:BHsqpQj3mesvHT2Wfez2UuMziMCLVDE+J1Piahb/nDNyiPYy30qYr8ETKSN7L:BH0j38Hy+NUyMCLV1P7XyQpr2f7L
TLSH
T1ECD42903ADDB221ED68673603701CDB77B19E36FC385312A94EDD127660B6B283ED526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.41\localization\el.pak
Size 1.1MB
SHA256 f61815f197a50251a450163fc560e068cf162456b9f34604ed052dca0c88d522
MD5 391c3da1140fa078c5ff607aaae562c9
SHA1 4b37ff6b6eb3260e127098bb56cbe66f0ba3090e
SHA512 f91539970d706b26924458517b212e7dce5f01c61c21661f2e75994540ade5a0575c9f915b1338aa1cad9378eba27795e56e513e9ee9d9ece93a3036c1f6af3c
SSDEEP 24576:CiFeknjpruB8G4eACNK9cwyU7fOILolJP862IAabmvdcf7Lz/DY/VeGzlmpPdQ4c:5FeknjpruB8G4eACNK9cwyU7fOILol2d
TLSH
T17635CEEFB0542DEE8046990785D8F07C27C66D6CE749CBD86229CB60BDF90719622E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs.json

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json
Size 1KB
SHA256 2a4b625c08bfa4bc038465c53ccd2c353445052024c3d22bd1380e570e46e28f
MD5 b47525696a06c9d7f95955c2ad552d7a
SHA1 13def0039ba42092095f8e3ff19d882c42c7fb50
SHA512 2a44a1174242b2c335f152d8e846840d6111fba5d0c9e45b43d4a9551167cca1218c3ae1c5b7d3a97edc5c6fccc57c614768e066ff13d9642e9db805de362684
TLSH
T1C631C860501A5073BF31839BDA973B2EA5034503A82C24E0F7EA491D58EBDC70FABC1B
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs.json.backup

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json.backup
Size 1KB
SHA256 0a30613aae3ecfe08c6fbe9eac8d2bd03d05efe2e7931156ca96876a8df916b5
MD5 ffa031ce4c0862b3ade1578bdf3629db
SHA1 5f04cdcae43d8ebd21ed275917caf63d159bc910
SHA512 161ce7da315ae24e253977f99ad83af218fabc9182cec5f468586f424fba7cfafe695cb3c2868bf7d373bcbdd2203e102d0d1f792ea2a14e9f684dea3a22392e
TLSH
T1BB31A864501A5073BF31839BDA977B6DA5031503A42C14E0F7EA491D58EBDC70B6BD17
MD5 SHA1 SHA512 TLSH

Submit Download

opera.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
Size 3.0MB
SHA256 c57d7bbe60d30e57ed593c6a628269e81be7e3a1bd37cfe76b61afa8ac5bba40
MD5 de6030a0391ac7484133ffca1ea36602
SHA1 d346ed008b0cb91c10e1bec2542bcf97cb4a2309
SHA512 71c4be6a746d5739d7bf35f9ffe74fe3edfa1adf88abde771da586816d5567adcaceee45b1663b175bc747b86863d01f527b355f42e21a555befbf8dbd759af2
SSDEEP 49152:rotEitR8YyeE4hV2uxOZLZvtd+u+8XaRKEyueQEEyx6juSZ:retSk2uI9Zvtd+ue4RSZ
TLSH
T1ACE57C53F2D910D8C019D079879A9633EA62BC454B31B7DF0A90B7162F7AEE46B3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\Opera Browser.lnk
Size 1KB
SHA256 b7c8303d9bb3281be790814e7fa151b1e8e04274a8e3c8bd13502e585a19b64d
MD5 0ee058b97c91ef76b00a6fdfbced01cc
SHA1 d93d44cb338e14e845133a70d22cc94e7625aa44
SHA512 6e1930ff7fb4ac51b170570c48931b56e3639e71c41163f626807004df44575ee3d2aa001e03a5f554a9b26e1474ed9b3e2bbc676c51ca2aa09a95cbfe3f118c
TLSH
T1CA213F166FCD3722F3BAC53945F21324C379B841FF964A4E10A023842E70140688DF6F
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\installer_prefs_include.json
Size 239B
SHA256 ad0a70852936dbf15eeb5accadd7acc1554959df5b85898911e4281e402e287a
MD5 d89bea9bbcd4817b77b7b90014f1da87
SHA1 21cdef3b05e461f645e198bb92f7c787ad0372dc
SHA512 70f794b897b35a6d15559a05cd358e98d2887096c60f7cac5c2e1d065e1a2c39618d64cc81b9fc2c3380075705441c3856b0df03eb6feb4396e8558ab2b1cc96
TLSH
T1D6D05E59802AC0E269B00287783633DDC24B1B0288616899B3C72125806DAA226EAE1A
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\installer_prefs_include.json
Size 1KB
SHA256 bb5374accc3de45596bf9b44ac5814d594e9d1e4cf9503734af94e9714dbc9e5
MD5 7d51489dddadecb6e7cb298ca57f3566
SHA1 c97c68f8d47564cb045c1dac2ae280cade6439d0
SHA512 dd1158c560fd174264785908ab1c6da9c70b0e021d1be2872b5062606d577ec64bf6c64bf9995a2d48a9555ffab7341b6add4030058daac372cc13f88282f072
TLSH
T13C1186A45446A053BB71829BD9AB2B8AD9074B036C5424D5B2C6481D84FFED20FA9D3A
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json.backup

Path C:\Users\Admin\AppData\Local\Temp\.opera\25157892-f5c6-4ebf-92ec-2dda2d98dc60 Opera Installer Temp\opera_package_202608220528071\installer_prefs_include.json.backup
Size 224B
SHA256 f799101396e58ec98238b81669c288b0649788476fdc997cd029cfd5239c8aad
MD5 a31327ed38a2e2aa048700169e5c9e89
SHA1 cee83a9db48bf9c0d963bc6d03cc125af5cc4ffe
SHA512 b302790a45f5cefca7131f81d2d15976d402a48147960dedb5eaea136205c7a5e04635521f08c63f7ab53f1b9dd283e575240076beca5f392f47f0522f105fef
TLSH
T195D0A755802BC0E365B00283783633DDC20B1B038C716899B3C71125C07DAB326E6E1A
MD5 SHA1 SHA512 TLSH

Submit Download

6dd838b6-1532-443a-9dad-7f724f6cf541.tmp

Path C:\Users\Admin\AppData\Local\Temp\6dd838b6-1532-443a-9dad-7f724f6cf541.tmp
Size 46KB
SHA256 0443bab24dce89bd68e06dba7f4335db89e70cf99ac92a0919d5df35a2c3cf93
MD5 a766b5a3e13fe1f2be280ef6c2bf50ad
SHA1 43f1375be6bf4852d9ad1b927af3932f0f2eecbe
SHA512 dc14d887bc542de73ded6a958a9a755a11d85c8433a23872a9ed033badc02f26cfa67e4dab979f86163f090b49ae2d269233f7cf84e583e62237c9225cb95162
SSDEEP 768:8kLVTQ6GG54B9DHJ/WuwLeu/WfyyK9R5dWLK1pIs4aAKsV2YxQfyyK9R5dWLKsm8:ZJTQ643LYTLzCPU4+pIs4aAKsV2YKPU2
TLSH
T1D723E16E8831DC70E5388E32E21680DBB53556F4C825297CA4CDE2F51D13B61BBCE9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4CBA1D08\installer.exe
Size 8.3MB
SHA256 b5515de1ce3b119be2992df38b1277c6422e2e7c66c8f10c5755ff3fbbfdd24e
MD5 d125f250c98bc7ae502ca435d5ae3fa1
SHA1 a79ee3e6308e305aa016582dff57629e792ae82d
SHA512 0901f3267a565667e4df3d7b5a8b25eabe3876a0e31b09bee2c7df646c8bc84275428091d8f6dacf260bdb6d301cff244e29626bde0594ee12af97187a2388b6
SSDEEP 98304:A5qhKn/TZlpgsbVjOIibQHedxKNQYNY8AFU:AAKn/TVdbV6FEQXFU
TLSH
T1EC967C53F2A601E8D06FCA748B7A523299757C464B30A3DF0A943A251E75FD4AF3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 756d85ad083e6b1cfff6212ef477dc5d15012325c27581b51e07060c1c9097d0
MD5 22ac28d603c8cd30d801a15bed53ddb7
SHA1 1a601c97b7fd8c608e6839154c2298598ee47354
SHA512 7930773fcf04278ce2e9490b9959dd9d5d5897c572f117776b33900f28c25b679f088aad4b28ff9838c0bd2199d9af8363b242c948406a674e16bbe360c157cd
SSDEEP 98304:eA7g37oBP+OunrvuhizFxerBlcIHl763Jale:jS7oP+OYrvzFwrBV6Z4e
TLSH
T15DE5235277858475C9B211320F59F779967EFC214E768A8B77802A2F8FB0280CB25F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcf5a69d-326c-4dd6-a3f5-2d73a923c6a1.tmp

Path C:\Users\Admin\AppData\Local\Temp\dcf5a69d-326c-4dd6-a3f5-2d73a923c6a1.tmp
Size 13KB
SHA256 35d78e805a910aad7462893e050376f9d18dbc73c592b4742e6ada87eff3f06b
MD5 08f7686326baa481149eeed33dc599f1
SHA1 291885ee6d064f0d8ae35c92bc0cd6fc35e44151
SHA512 d5580726adb7b39fc67a2566b42ccdc4f0db0c2d5be27d027afcf005e9145ee84887d0ada93d5dad1c889112def64525ac05716a8609959df2f85dbeb42d18b3
SSDEEP 384:NMkqXIIKqOR/UjJQrQBe6nHUSpM1L0kkW+54:NMsdMVI6BpM1Ak64
TLSH
T15652B07DAB1BA841B1CCF26FDB25C8055304FE4B9834A37639424F8199DFEA2152D9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb9f4e22-eee2-47e0-b4dc-8acbe02f258f.tmp

Path C:\Users\Admin\AppData\Local\Temp\fb9f4e22-eee2-47e0-b4dc-8acbe02f258f.tmp
Size 2.6MB
SHA256 71c7a508f591d1771979df4fb400556c4df21d8937e017e322ee1c4749dda428
MD5 cc79434c290887ea9f9eb97967e3ecf6
SHA1 a3c9fa2a279a6a30c7c44240331c500e37b3e004
SHA512 49bfd073fdbdab7ac6adc62a3f2a5115fce06548d124ed355f40e8234329028499d840785bc7b2e55a2f3ce2fb9d77bf6b2c3efd70508f6303ed0ad861c27fd0
SSDEEP 49152:uwEkdF+R+C0LfbAeXf4Lylz4wXH5wtC9HP3W1FPhMZSXUq4yP4wITCvhbgK96H3m:ugTYYLUDLylz465OCB34Jmgb4c4wIO0Y
TLSH
T134C53341B62C4A21C023E737C2904F763FD9D5309F166BCB8263E4F665E89822F656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon_opera_one.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2656_379976330\CRX_INSTALL\favicon_opera_one.png
Size 2KB
SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
MD5 cd78c5defe6084243478de9874682e1f
SHA1 708c8c0649039ce9b3f8894d00b712d65d488ca2
SHA512 96744c72f623462f1c64c2e49e7a2387846ed65a78d94841adb3bb5b52f27d28f657ca3f2910b6b1b338a032a9b0e0ac47d23e7b25295d6841480b32268f4db2
TLSH
T163414D878974A4D5FA41D0215A037D9EF9BACDEF40970E5010D9043A427AF5573AB33F
MD5 SHA1 SHA512 TLSH

Submit Download

de932af914ba00303d4a2778a383ac9c831101e2.crx

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2656_379976330\de932af914ba00303d4a2778a383ac9c831101e2.crx
Size 4.5MB
SHA256 178de7231e855207b84bb36cbe9a9fbebe1965135352f81ec3036d05cbcdea0d
MD5 47bc63710fc5fdd4062d34d0220ef644
SHA1 556a946b455f7d92a80396db3da75bef0b177657
SHA512 e0f0db9f5960a943b785892f7560c6a4a3a32ab81ee90066c5a649582d6d43eba470af49f7b39f3feef8719b53bd850044e0327ce73583993323f12714fe698c
SSDEEP 98304:x517Pcja8RdYhJjOwwDBplGP0gEdOOLsp5G3SrwU7EbPEDKeIrQ4e47:x3yaiShcDvQP0vOOLsp5B4bPEv/4e47
TLSH
T1E026336863D6E731DC23C872410697E144AC8511A09FF92E1F241646A657BFCFB8B27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon_Light_Neutral.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5872_908487333\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
Size 2KB
SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
MD5 0566b67d5fa120d6da250a92577c8873
SHA1 0baf54c5f6a7b8cff4c82d22be9113c43a099c87
SHA512 9dcb904ef68419b2462d88133e87d6f4258d8f53f05ed12868718740d6e9467ab2d8769a79727c3dbd01c6807aa5e4863f1874465a7dc95088bd724f9d897fb5
TLSH
T1CE516D6D716E2332D0EFCE2E04C6860EF8680E9C50489454BAD506EF8905B9C9DB33C7
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\CRX_INSTALL\_locales\en\messages.json
Size 401B
SHA256 9ad8ffac49958d5bf771eb6f0bd7462b32597696c9d0a45ade771ef8c124b1bb
MD5 f58e359a5a09514e503a7de060e5719c
SHA1 469e51c68e204d8268eede68ef1cbfe1e6732f97
SHA512 5498cbb61a7953f5780fff2ebeec08e48daae206e5c237686b41f771370874bdfa52243db1050b67f052d7ea400e385f73cc4c41185194f006c73f2e6f174b7c
TLSH
T1C8E09208D940AE6B52F792123C787A15F72E476B0500541A7DBC500D0FB1AAAD662B58
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\CRX_INSTALL\_locales\en_GB\messages.json
Size 387B
SHA256 554cbb0514a7897ebe50043e0de9fabfcf321dcbd3c39e77cb96e62d871c7bc3
MD5 1843060be3fce65295490b449d0866f3
SHA1 aafcbcfb0bb42b494528e41be2c2c1a0b988be9f
SHA512 ed8eec1c2d311979d3643e2110ab94e917706e8a6bb04afe81d04f3fdc2b666f5eca044f7d1fc15330f9bf0e7a56d05471746603b2cc40a9a007540d4afc2910
TLSH
T1DFE09204D940AE6B42F642123D787A15F72E476A050094597DBCD00D4FB1ABAD662B58
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\CRX_INSTALL\_locales\es_419\messages.json
Size 424B
SHA256 b04b308252b490b9555e5e002c5c6da63f3a6d517e2f659a626a500467e21100
MD5 a141894bffcb1c948e75fa3a4cd1c0b9
SHA1 ee4ddd5e77b511bbaa535d683f4129cdf542e941
SHA512 6dde8048629a446aa9bd24b4608bebfcaf1555cd38d2f264c61e7235141ffd871993279044cc7f88a3fbd608693f6af78ec10f4858def821a646350718548a6b
TLSH
T162E02B04D890FD3705FF52063898E616E3E047913814958D79AEE25D1FF2EA65467F08
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\CRX_INSTALL\manifest.json
Size 4KB
SHA256 dee09929862d037e825b73576a80272b344d7c8e90a3d245a658f5b54486e9d7
MD5 4fb4948fbe85a9db6a730c9fa76c560c
SHA1 85cdce88ee28fc036c8541ff46becf01e15542d3
SHA512 b0108c9ff1aa6983d006bdea9546e9bdf11823461860660cb3c22379a465f4aeb00ebd9cdaf044cf3015c295d5a45df6d1770d3375ac50297f7d74c2ad83b701
SSDEEP 48:W87nr6m1ND+SarEP3jPg8DZ7yGJQD2S8lciKVlq7mobZNp4HHK/GJQDrFkSRi8zz:TF1AtrwzlBvS8lYTq7moJ4KOJAz
TLSH
T15EA1EB3AC9844C6B65B6B374E8B84B07F641A3AF91806E5B7D7C65CC0FB75029A00F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipeline.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\CRX_INSTALL\source\shaders\pipeline.json
Size 146B
SHA256 9e4ae1e22f4ebc23b914d04a4d0cd0b79639dfa609d830b62cc0285dc4a95bba
MD5 8489babf19ac4fc2115f3bfe04819ea5
SHA1 406856b7b0f87f2249bc12d9a66083e0fe82172d
SHA512 bd7ef24ddb3b6612efbc803c5aca007e2f3aacfa4c6796a4bf5a12b81bda9189d20d3577c3acdfa7e431ca3b0d558361a092469b6c9f4d48cabb5a770b7c01b8
TLSH
T1D4C08C0BC4A08C7D04AAA266000C180E42D4C88714000A2C32AC006C0FFC90FA86180A
MD5 SHA1 SHA512 TLSH

Submit Download

accent.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\CRX_INSTALL\wallpaper\color_picker\accent.png
Size 99KB
SHA256 0ba039580d11744514f1734bd6ed144bcd8ef605f61b9c4c2fa300a5afae3348
MD5 7a19de281d5de10276dd77162a318bf1
SHA1 fb76af7a38124493d85d6267662e3f7572ff79cd
SHA512 fd79409d1061a6a3125a8030c5a14ca2f59293b5dd1ee660f287a3576b56ac05a226a70d1c297e773b5917d208055581141b7195acaa4f4618eea5e079c34f52
SSDEEP 1536:WlBC7UjkqwGDAQpFSr3bT34CU/hEJdeGEmBK1fGdLqh0aa1ePZT2kh/ZtxL2m5ki:WlAqRDAQpUHIBhWdeGDEOwjzZPL2m5t
TLSH
T12EA31367B423057C14269FBBE1062087EFD12F8EDA47A19D522AC074B6EA0C2FD1B674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\CRX_INSTALL\wallpaper\color_picker\background.png
Size 70KB
SHA256 44cb4f1b7692d39f251bd2dd24352fff8ce8d9b2bcc47506e642ee4dd3f96f11
MD5 e5ac1a8def81a25d3d51a15937c7215a
SHA1 1e3a42721c2523089684e1000428dcc45a8a7a65
SHA512 007a3225fb3e4a06710cb739c408facaf8263c5cdb45b02cea3a9ae43ab47184b32adf47d57371828e93d24fe7947adaa4c5f786d2937bec20d464eb5758a02b
SSDEEP 1536:ilpKT1ce5v1OVugThLGvD89QKSUgYDDGW/PS+W0+L7T5:ibK6mv14tGY9+BV041
TLSH
T1D3630261E746BDFB94B65A31CAA35E91C56DFEF09807CE88189B9B340E4DCB80458F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

additional_file2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1920601632\additional_file2.tmp
Size 937KB
SHA256 73355e09adb2bbb96a8e146e1098ad18036d58353d87f78cf4e6183c1f8fa8a6
MD5 97e7912e523ee8b336116e9467f53343
SHA1 713cf92f71c302a3dcc0c681c2ea34c9f6084bae
SHA512 922061ff99803e56027fbbc8406d0ca83a29b51f86554ca21800933d2082ebb33cc477e15210283b171c19243255a40e5bdb9bbbaa481ad081eafd5d758bccff
SSDEEP 24576:AjEDWBvvZmpgffEXN5ECpw73j5eR465ZXS2Tf57HTSIDx8G:oEDWJZq7EA4j5W5XS2Thb+IDaG
TLSH
T1E51523A01FF2C02EC42207387510B51B8A18E995D50FB8CFB69A9325057AD8D5E6CFFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 8072005172186b75515845ebaace3ad7098a7bd274fad838c5201bdd40deff7b
MD5 f447d6c38748bffc4f8420d33c6c57a0
SHA1 9412c087c4860a45da10b1f7cfbb61ffc8a3c019
SHA512 10fe26953deaa9547489a5c0b783260d0d5ab1493d34bd3235a444eebebb460d695a9cde628e17cb1b1fbfd7ec93049f1599e82ea63dd4a5eaca44ff12b91a21
MD5 SHA1 SHA512

Submit Download

173eea74-6910-4678-8cc1-e2413d80289a.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\173eea74-6910-4678-8cc1-e2413d80289a.tmp
Size 10KB
SHA256 a54b1061d2c29f8fc6b242af6d9edbd686a3dbd6e99d289c917210d4306fbad8
MD5 702185d964c76dcf572cbd24aebe9a5d
SHA1 78c6a18d659a8aa0740e4e486b7d12cb8e8e96de
SHA512 c188a98d0c85ed084f0145f9223f0bfe3d7774f82a87b92f532ed61f4c708111a7179444c65bae03e0db8d5b9f7abd1febc80c814a83e5905e9b739fedcacd00
SSDEEP 192:hE0PqNQXDXPWyXeLXoX0XMXhXaXKXqXNX1XyXGXIXFXwXSX8XKX/XBwXwXWXcXen:QAjFIm0Xq5YIoVdQEGtOwaIvMOU68UfO
TLSH
T13832234695385DBB0CC66925FE10B627F3E80012A1577D95BBF9C82C04CF2DD29279CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

489769d4-66da-4283-9762-37a453981f98.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\489769d4-66da-4283-9762-37a453981f98.tmp
Size 203B
SHA256 34f64bd42cfc4d853795035d87823c739ee40d0b5dbb36f43f5ed31f2e0264f0
MD5 e997305ed4a049d4da532bfdae8eaad5
SHA1 db03cbbfab2f5527a7597b48e6abf436086aad6a
SHA512 e086f2eb182db559e7f9d18f986919051f42940a7afc07417d830ceab974ae05462053060cfc4bac66fe6e3514d80db1b73df9b6f6ef6deb18f2c0844a00fa79
TLSH
T11CD022281A159612AAF0F2B0AB647F5B1B394C324A402930923C162F001CAD8278073A
MD5 SHA1 SHA512 TLSH

Submit Download

8530a2f6-a66e-40cb-bc6f-9b41537f122e.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\8530a2f6-a66e-40cb-bc6f-9b41537f122e.tmp
Size 203B
SHA256 dd6d413f2ff3100677e338545850346deb7385739bfa994f8da305c32456860a
MD5 e940cce09e9c53ace8b20f1b1a2ab2de
SHA1 9c5a58e91c799ffe6d4a9ab8081eeca8fffb1557
SHA512 1282931a7084768412e87c7d514a36e1b96f044714c46256e2edd9894686dcb72d4fcb184ccbf10a2dc4de3cbf5c50128283f6cb6dddd7d85742ad26e1076618
TLSH
T188D022501E89A91561F0B6B4A2A83B2B146E4B300A5A9C3BE23C4223926D195038DF39
MD5 SHA1 SHA512 TLSH

Submit Download

9add5159-0ba3-4d4a-a155-40a9b9b0d13c.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\9add5159-0ba3-4d4a-a155-40a9b9b0d13c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Bookmarks
Size 36KB
SHA256 126ed11a514f014655900d4dda0657cd9142f159883568dd590641c3662b09f0
MD5 851041aa3d376273cd4381d40b41f78b
SHA1 c6c64fc9735917e2fea3e08ea3f668a7149423cd
SHA512 45bf15e2504cfc758b856f16373ba8f1554f186ad012e1012667643f4e699faaa332dcbcf6d4686f2103c0811844c99cd4a777bb74e95fb0693041860b7041ed
SSDEEP 384:odYkNZY/c1X0N4O3TIWwSf5MRfpJ4qpbh6W/wWQpgTIE+wjpYSMerSx:oYIAxAwoMAh6W4WQpJE+waSA
TLSH
T174F2D537C4066CBB417413D574FA622BF78A232F59888D4B7B7CE84C8F75923625AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarksExtras

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtras
Size 158KB
SHA256 270a2e0330cd99a148d98f69863c49a4cb6293587e0e66d59423aac6924af2b4
MD5 d7410e1ab93fe9074d59de4a1ac12ea5
SHA1 75c4f13ebd25e8ab22c56c707a049dfa69e0843d
SHA512 5583ec43471a2ee92ba8b5e924bdea7eeabf8629e80d38fcb73a0360e914d2bc864ee2be468d2123d939892ef6456b3d9af24bee5bad9bf1f33116782459df99
SSDEEP 3072:LaeC5wQuI95lsiY/Kg5gic/1b/B4ZhihHwD421btSiJx6HboKNwL:OeCWqPdY/rgic/1bSyHwD421bEiJc7oD
TLSH
T140F312F39A820F2FEFBEFA3B563D5E15AE094D5718C9114909A1EADD1243E05CC629B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 51058d61de73de2115a47f75feccbe4447fafb8814116484ee4440f93807d353
MD5 d42396e4d5f9ce95f29e062ead020f1b
SHA1 662bcdc668741cb2f767d5ca7336a51b959e1dcb
SHA512 b7148016be88213c358ca6e68dcddc1a49096835a57df4c1d194a7a1b42b5f359238e862d373c1a412cc4eea6036a951e687238da1fdee1c08a08e737094bc6b
TLSH
T1040146192CE82227FF84013C809B2E525E3A2E324400074B6396BB54E88E2E5317942F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7097a857a50e53a380c569ffc05de69d0941313d7b6741b4861b36b1739c602a
MD5 f6d034d4df11c24f176397aad1f2f3d5
SHA1 b12d137856409caa8782a9ea3e3318a4757fec83
SHA512 9cd60b6e14b1e5016feb70aa258ac03de74ebd3d1ded02f6202c736fb7c86e601c5fda1b241cba2e47e4f81e42bd1ce5c9901418b7a9e36b0a1fe7aac0bcdccc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 ad5b258c2816f472d8d1201342cadc52b7665e78b651b282e5c2001c90cfb60c
MD5 e57f2eb12591e8a7c8edbe51ef86c01e
SHA1 a6aa8dd974ec74a6178de693a51c96d90104f6fb
SHA512 2bb30906767c6180bee2856285b83c213713da2eb54cb36ca5ed2ed3f083b91dde1b06bd90ce91f017c56f59f3b11008ccd05ff19575e18646220cbe46b66d24
TLSH
T1DDE022B41CEC1143CFE5063443378F84243E2EF20012274BB0E2D279B69B5F9B22A50D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 36fd0668184bd6fe6158ead8d9dde64295ee564e15ac365e8a119da6bb5096ad
MD5 fea2ae19845dc47cef430875ed1fcef2
SHA1 1ee48080a6ddb7ac42c038df46757169678176be
SHA512 79bce61e15d4a69e9e5b41d0d28de4e0475bacc5aef2fddbed57846cd882d7c8f07be560fcbd116e10f2d75c18f8b297affe2a62b3ef2e7e9fc53b10f1952801
TLSH
T10DE0A7782C7C1107EBD1027862A34B5414352FB14011164A61D5F278799AAF9B25792D
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\bg\messages.json
Size 580B
SHA256 f1b238d97566981d936945e64c0066b1d4fd3f6392c16ac0463d3b46fd468714
MD5 d3ad65b29285d01bf4747d00aa8910a7
SHA1 6e64b63ed4e895ed7a2438f8d1390ecf21550010
SHA512 f475ae65a88f0d88f892320736559523a696c6c9c5ce27d0e9d440ddfca6af2c6f6780fb4ce7eae35019aaee05cb71f060754c114d826a0f8092962ec68ee7f2
TLSH
T1D8F04C848846FCAB01A2D119AD103A04BCB413FE3E40805B796C2C5C3FF556486A2F1C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\bn\messages.json
Size 809B
SHA256 80a4c1efe951aa776823557a3c49b8fcd62af49a14380a318818e3d0fddd214f
MD5 42f50a15322c27794e2fa5fc6f2f1a45
SHA1 a8f7d05f1a467064766bf73d80ca07840d145ca5
SHA512 f6068f5f0b2d1cd17f0557bc13a5e0a344b2d5a42c53053748afd67196c45a8c1a287c450a76e040b29a3192fff63769e3e9c9bdbb83550aa7480b5a449791b2
TLSH
T1E101F700DC2C647624E2CDE52B4C7334D5278F5B42A1E34CFC1B9108AE3CC3D4496E54
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\ca\messages.json
Size 423B
SHA256 f94aaf624b73b7969b44341b56e593ffa6deccd92169d1bac059000db337acac
MD5 58deee888c404a3adda813e6c93f2ead
SHA1 2e4db32e615c6ea6f03a79cba7b27248e129b373
SHA512 ccc40e74a346a881d97ba3f301994c248b7a0b31ea015d06976def4d4133a48c9bead28141a1fe7e2a74042102e3af5661a134fdf9da9984f14c41f3428deb20
TLSH
T1BDE0A3019840BD5701FF121F3A647356F3B407662C01514D795C814D2FB29634423B0C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\cs\messages.json
Size 407B
SHA256 2819387ac23ec4550a3778be820522a7fbf0d36d4859c0c057eddb199e4e41d9
MD5 adc9447f04249697cb3bdfd7dd04a613
SHA1 f0b865d8fa66d31a780838725a554659fa5cadb1
SHA512 b84d7db0155483eb1cc4acc96ba7ab5439e7a4d2a5eac22b1b8f4f555eef89ecc90b5ff5688c58a93a7b230ea43bffefecd884236e2b473761c077ef89b77e3d
TLSH
T163E0ED04C856AC3749A502133C29254CF56203A61409A48ABA7E00894FB39AB54E2B09
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\da\messages.json
Size 393B
SHA256 3f9a707d9d1489662efc26127b48b5eaf4df20e32b40b73d4a334b772f0c92c4
MD5 a264dc3ba363f99577a904605d9ba433
SHA1 339febb742ac432049223a98a96050a5a27783b4
SHA512 770512fe48408fde063d1ccb4cf4898b811ab52027e8b41cb888394aa33953a53b6bbed105a0b192d8ea150c431cd6acdb20a388aafcfdb2825ac33249dd76a1
TLSH
T105E022088D51EE5F69BA43637C38990DF2A003AA6410948A7DAC800C4FB9EA746E3B10
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\de\messages.json
Size 425B
SHA256 18093b5c5134109d7e7528fa6a92ed1adf36b351fc32f37158bc88064e541a0b
MD5 2d4a3b95d7391b5c964adfd7fcacda7d
SHA1 b0bfcdbe7d34da03d9f767f38e96bfc64757721c
SHA512 7d681574b37021421435d98e7207d09bf2a63a53f5ed891d86687872860a56d9935dfd7f45b24eb7628a000b17ddc7ecefd24c21791d356e64347f250650adb4
TLSH
T1D4E0E5008D52AC2683B653377D28AE4AE2A953AA4600901EB9AC405D2F709F38FA9718
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\el\messages.json
Size 624B
SHA256 6f10347307c2d5c1fab911bc6ce07c6edea922bb0ec575cc908bdfd4accbec8d
MD5 d005da31a78fdc3867a6ba570c209368
SHA1 7e55165580b026fc8210b026f25a706d726a14d5
SHA512 1a7f8796f1847cc8c2c5ad820ba4b739a85e9b3d7c35c8b830cea861d9b17fe7f5b90f8c41adf023d9aec5c9de9d8fa47a752d09436c58fd3c4db57b07908602
TLSH
T17AF0AC6FB4145C9A1069430768F474AED2C26E286A00D5DDFF6DC6047FF8523C822E0F
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\fi\messages.json
Size 412B
SHA256 f886a0f236c6741488d6b001717f1b50dc36863365ee42692b3cf36abbc2334e
MD5 f724c3f2cdbf931fd27e76538d5322c7
SHA1 2f4f16c0ce0d2c3a0d50be2e3b58b264058057ec
SHA512 e4cadcb4e0d40ac8553ec30e2999ab391a85b2ffbcb9879558df787bd687cc2f24d943e7efc926282409f74b0aa655a99d38b053df7242722d55fad27d30def3
TLSH
T11AE022009C45EC6742B6036A7EA57928F2A103BA0820944EFEFD804D0FBACA358D2F19
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\fil\messages.json
Size 423B
SHA256 2c5501932616f21b4523f18bbbffff896a16e993b2a482bb8a8961e8d15b20d4
MD5 ef2c5b9908d45ecf0ac0b87031ff34bb
SHA1 08d147cfae6c69b6987736549950576ea999d6ca
SHA512 4b17c90026bdc68914d3114c2db0a9447003f6a04c56aa8266b63c005b34ddec83ec3dcd03d2913910fde40efeef231cc1aa1f34c6782453d1b1664efe9245c8
TLSH
T166E0E5009904AD2E48F606133A78B509F2E1139A2B00946A7E7E554D5FA2AB3A662F48
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\fr\messages.json
Size 435B
SHA256 6c5b067f98cf71722061022118e825cb753050833c1079c06809c1eb92e68737
MD5 27773b6545215fd9dce6d671200597b5
SHA1 5d42225ae742633e687a33d771305bf16236ca6e
SHA512 db4873b31b1ff1c231d18ef9daefaa5d030b3c616382cd4f68b1629a53e9d51ccd7db5cba0ae28f2e747828a0cc49ad782d94aa542ff6d20d8f42e81b4e242f2
TLSH
T1F3E0A0048890A92B46F206233E657604F53487A96510A159BEBCD24E0FB19BAA697B48
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\hi\messages.json
Size 700B
SHA256 7ef2c7ab8bb7f1fb2b52901fc7a7f0e09eac95a6ef1bfea818dace4484fdcba7
MD5 db3b3c7f91f316d77d6e1e0b913388d4
SHA1 1b90af231606219310bb958566ab74a599b6faf6
SHA512 b1061db7261ad548c5db31900fcbf27780daf0277c5fb92686fdcc81c7c4b4d743157aedc5a1716276ec321a15e2c61abd3e4fab3f83fde81eb632683053c3d4
TLSH
T1AF01FF0CCB78F62E08BD395A759D5D3BC1F8237553A4516B7DA8B28A8F70CB14852B28
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\hr\messages.json
Size 423B
SHA256 00780fca6c30710c79858b69990c0f6dddc3b2d46cb759202ce66da11c85bb6b
MD5 e153a21e92c49a1e1d4b3222cd50d593
SHA1 94315f28a99aa60ad278c482b7e6428683f9f0e1
SHA512 50f7f40d67d1791cd7a45bdec20608b29ebfd81c8c8f5cd7c58a3aa280c5d6f7cb9a47f5c84a69183c1df2d75e8316b00309296825ac331e00eb27315e637993
TLSH
T102E02B05CC1B6E5345FA43177E766544E3B8632C1900E2ABB97D811C4FB3DA246B2B0D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\hu\messages.json
Size 440B
SHA256 c5f9301cd0674e4a184436e5dc26879c980baf66bcf0c201b010e26325ea6e9b
MD5 6f141e3b8e3a1e88c72cccdc3442ecda
SHA1 bd1889bd8ba81c3c8f3f4c348fce8ad01175f2db
SHA512 e20ec81a50c1e991b5478167618c8aa7f72860eddcdec942f58903e74e8499abb9a4e3b9ae8e182a652cb70023f7936fe009da443e18d0cd448708510a9f3ab5
TLSH
T1ABF0EC14C930FE9687B2470A7DB4FD05E268079E1541556FFDAED0081F71E6A5871A48
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\id\messages.json
Size 391B
SHA256 14f3c6f716b3e99165d5388121f6ed901c1f5acb05420c1573c9e513769bd26b
MD5 3db3160f1ac8d49cec49658ceaad42f9
SHA1 8cd4dbd8fde8472bcca6c92896d6109e07832f88
SHA512 cf0d03bf04ab9e0b42b1aa2c02b1af6dfffa8db9ba5f6e8a3aff605f67f051d5065158b1ac70f7ff10b96a91cb2696b26c8495a5ac0ef2092343b24a1f699211
TLSH
T173E02B054C48BC0F15F546527D64660DF6E517641504804EBDAC59A81FB3A739552B18
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\it\messages.json
Size 427B
SHA256 50f996c101f2e54fe0f2c88172c259abe05b7705a7b13ff049fd807a4399bb23
MD5 842d9b9c4b8fe22e68b605a2899e0555
SHA1 c751bfffede504930098df689dea75430e412017
SHA512 595d68aaed92c89547cf29cec2e635dff37ec6d924b9fb5add06309a20eadf13f7abf7459dcf6c5119e652c9f4946156e015d0fe6119a3ac000ca6681f9aa0c7
TLSH
T113E05C004C00EC3705FB53167864B188F7721BA51800496D7D7E920C1FB2DE75411A08
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\ja\messages.json
Size 504B
SHA256 db19d6d58fb03ce604d9c0840c08707d3948e16682aee6312af2a39d954c7196
MD5 d264df30afa79ae34008f476d7ea7084
SHA1 8be7b5af97371be6ecab2a5235ae879f3a821052
SHA512 296833ddca1608148e658d9d58af7550337cfc3b4732758e06ed43fd3aae7fb09291e6720e0cba6805b84bb90c5fb101da2fa6399e85695bd4b0554ba9be7100
TLSH
T11EF09E0DE74098360D744F11781D3344E2685EADC1A4A11A393CC0184FB0DAFD812F7C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\ko\messages.json
Size 440B
SHA256 00b0041d93c2f2760e964a70dc3dfbbe720a3f261bda6e5ff6f052106f4628ad
MD5 b6a7501b31ab1349c9a8af28e8248ba5
SHA1 e3616e9206c9253bd8246e00a086bcd29519ac42
SHA512 efaccfe1264bbd5a8337975ffb5e50c6e6b2d76cc0562fe86ad3867cb6d038925f14a257ad89696a1b6fff0f2ef4453994e446f6799624890118e7c242f08a99
TLSH
T1C2F05C8998D6A95F00F903123D60B3C8F39247660B114489393CC14D4F71B72989AB1C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\lt\messages.json
Size 428B
SHA256 2a53a1eb30e70423e4c146c3ffa96ead6d1f1b154059e8de7ec7a5960f2686d1
MD5 d4c6ec487b629c9728c35fd03417fd50
SHA1 b1a59b269c83a909d2a049754e6b70888ff748f7
SHA512 a3d183a0959e84c7d14b4721d1f4f451df14f413936902ad8559c2d2db4f4409ae727ba3c872ee6e1a36a86013b4778f460b5377f912671a7c2e0b251eeb8c3d
TLSH
T143E0AB04C8409C6B86F95327FEB0B708F2E003AC480984BA7DBE810A0F36D63A022B24
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\lv\messages.json
Size 421B
SHA256 3b37352b3d148d7295cc0a124da57f7dbac4e98c19c7f31dd8abf2d97726d886
MD5 5efcc79321bd89ef205c29116d439d7b
SHA1 0d39d50caaf403050fee9a78ef31bf1479f385b2
SHA512 4b813b00554f93b40dac970c5343c026079b665d3fb640d75048c2592fa389a244662feed7e540b6643273c81c7209e3590c2b298584399e82695e70766119d3
TLSH
T19AE05C095D069D1742F1830BFA71B185D1B853791400C10A7A6C958C1F71A676462B48
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\ms\messages.json
Size 401B
SHA256 0def86e8de9487a64067843a8d672c027fa1b5c59e10cc60e0f08e2128dec96d
MD5 7c6cc1418f2d3e57e3ccb95478e7130e
SHA1 ce2ad4a9f19a4a3be2377142461d267ed27e2144
SHA512 5443bf0e2e3fb252303649ef35e6a4620a9cc01a496087474c756c59e0683067faa8e0ab43b3cdf7f2fa998f8fdc232ae414dd3441a873404f03eac5750c339c
TLSH
T1F0E022018C49BC2B1BFA821238A46219FAF513690604D44EBD6C4DA80FB7BB39961F18
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\nl\messages.json
Size 413B
SHA256 07962fa5344089532f5eca07d17319610f18b573cf2a0dd24cdef3b3261e6477
MD5 29efc1f94f9e94946ecf3dd2f0c8c3e8
SHA1 7760a370aa9530db22330064b1b90cbc501d5ac4
SHA512 2c1f34fcce1a770d3bde8b356d81cbff2da660c66afa223a0f7387d2115c94765f12d8eca3e9cdb8267e9563e15287a2df770e3c4f3dbafee98caca6f59ff460
TLSH
T1FDE02B059C42AD1B86F1032A7C657645F7B143F91500A06EFD7CC06C8F738B2D952708
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\no\messages.json
Size 393B
SHA256 d3c23b53ef4f66d8b8730a570135a9a17f1414a15386b0d007e77287ecb788f3
MD5 9e4632d21304c4d4f7ec8c1261e3c07f
SHA1 8bbaeba0282e937b5f87af2c028555647afa55f4
SHA512 40920fed6f56d3f163654ec579595f99c79d5d442757faf4b59844f8c3fbdcac43b10992400019139d5dde11a433965df915357678ae0203567f0359355c23fa
TLSH
T13EE061048C61FE0B15B607533C34650DF65153ED5400988B7DEC410C8F71DB745D2614
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\pl\messages.json
Size 431B
SHA256 8a5de8af653b76691d07c35ea43c4f30c144982db249f020627cb78d9a9ed4e8
MD5 7ff4dc5829c3df620188ea00f4a679fc
SHA1 85b924580a0143ece3b89a2b3e7eb7fc28732582
SHA512 7dcce2836b7afe24d2e0ad7ed4e57ed5168328ecb380f40285803daa7b58b78606f617e93cdbe367bcb0552e038b5a7dfd088f4070ab07c7a10f50bc1ebe82ec
TLSH
T158E05C0084406D3705F941167D352405B1A532A56816D019B96C804C4F709EB28DAF58
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\pt_BR\messages.json
Size 419B
SHA256 b292fb9f8c4a8c733e033fb8f85cc940a8b34cfdc349e7e54a3b8ec13aeac253
MD5 91dfc26eb40d10f461747876c33b32a5
SHA1 1f95c3cbf9ab8bfc7bb6cc72c404a050fb4d3a0b
SHA512 303b5cbc3b1143143b97e28664e3061389d85abd677679a870be52da16d47f62ae1d14f13f2305ea58c6a313bfd17e1a10eeae1f61a7f6ca6e4493d0a89d1251
TLSH
T131E0E505C860B93786BF420A39B86659E2D407AA3804814E7AAED28D1FB29629067F08
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\pt_PT\messages.json
Size 422B
SHA256 3baf77d76ae8fbeba0ac863f8e22c7d22084cf254feea227f37736f7a142b068
MD5 2dab029e56605c5c74aa5b980a7ac0cb
SHA1 71b236687e5affff215af726fbd32e86d5d6f58c
SHA512 6234e00cdb00dc11ebba0ba040b7b3cb4a00ddbad83c05698b91a5aae8477b11ffa79a6fb8683538d4c0ff5c9eba39b86fadae0bf44ef0ca15b3abb28b8ad6b6
TLSH
T1E5E02304C860B93747BF570739B86699D2D403E97804818E76BFD14D1FB1E629167F04
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\ro\messages.json
Size 433B
SHA256 e090811708241a42ab71f0f2e5f94c5a0e55a5d38a9ccacf7e4bd33ed8865574
MD5 d328cee26dd243964841cd74fe583c70
SHA1 fc32775499a4a02a9fc2311696da7327574f9fe1
SHA512 44dd2e087aba7b8c1fa8980391a4e846c824182208da0fc384bf33651ab71f6facdd53b6960c4ca77f5807d14cdd66d926b2395d326ab40e9cd5b8fa2b0a6371
TLSH
T1FAE05C08D4A1EE5701F7C207BC607556F2A503A9180490DEBD2C968D4F729A78554FC8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\ru\messages.json
Size 609B
SHA256 85017824ddfefe0789b0480bced2ae1fe1876c01b3adf7d033a16c6407d90ed6
MD5 cc919cb2795bf26f01534ea90347dbb5
SHA1 d4069cd8ce82a5e121265851dcaf64a14a8664d0
SHA512 02249033ae02907db8dd5090ec2c008f7b65c8307f8d0c4a502027f042992d99af0fdc4d8c276403228f7aeefeb2dfb6dd22152b9db213dbcb4a9106dc90b9fa
TLSH
T175F02D418858ECB70276E117FD607D04B97906FE3A0951693D6C2C6F2BF24A9C1B5F0C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\sk\messages.json
Size 423B
SHA256 5bf2b036a0036d4bcdcc414d82b33aa83163cb9c8341f884c2648d7fa8aa333a
MD5 b5d7329719a7ba452b139e76db6c996a
SHA1 c6b761c3a47efd967ef82d1d04e46a30ab245cc3
SHA512 6c4b49d02d6803d7a1f2ba97d56d4893c8308daeab5c8b71774a22fd6c64a4b2261f4657dcf53ce3a49b07c2ddb8a58604b8be6db55b114fa89fc8efc9654a03
TLSH
T10EE0A304C844FC27467503433C743388F251079B0404D466793E554D0FB356B91F1A0E
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\sr\messages.json
Size 578B
SHA256 4f724533cdf53b2ed7d49f185a43aa18b34a14170e0d67ebd61d4e745491ea02
MD5 50fa8ee074abea10e8eeaf23d00d6798
SHA1 15646824c2d2ccdcd46f9367827dc9c33e0eb6b5
SHA512 7af804dc082ed06506e3d78a096a02e771a641ad8c6412cb60b96617be91fc42378b1c255fc77ae7f431af6b85a98129fc4ab63ccd1327aa257998ac91eeb5be
TLSH
T1E3F0F6A4C889BC7B0AB2E117E8247A04FD7D03BD2E958156793C1DBD2BF15758161B2C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\sv\messages.json
Size 406B
SHA256 9bdc0eb2048e133c2410e2352245c5232d85c85db94a9708e493000a02762d22
MD5 c723843a1afc66a011bd175e0bc58411
SHA1 9af404fe71cbf55c0b1420437ce4bfae2a9e769e
SHA512 97b6a249a0b1911daff58993eab9802e9903d8c2c7b40fef8b490b579d5afa7ea48677538c52dd700a194807900bcd2e0cd2d8d82f9dc86b149089a1e56fa32c
TLSH
T138E061048C50ED5F67FA47577934554CF2D693E94850A44BBDEC410C4F709F615F2708
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\sw\messages.json
Size 422B
SHA256 d487bcbfe9f0b6f87617fa6c4db5829d2de348a56417cfdafe310e5cf358c53a
MD5 47312177261f8d76a85df5d173788015
SHA1 dd773412fd371caf5c1ae0f0d54a6d594900b9fe
SHA512 4535eb8516ea13fdffa06ffbc53c99dc2d1cea498a672b570c36306a764acbfb651cc660e8e755fd901c473aa5b2a2e99103d64d23b92271f9279d4fccecf9fc
TLSH
T1E8E0EC05C500ED3F05E6415A34606740F3D5939D1811944B7DEC974E1B72E6794E3F08
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\ta\messages.json
Size 778B
SHA256 22d933c85b88d6b20e6ae9347fff17114320cc47cb4a6231ad88aa71394f6011
MD5 a80e736997e678cb90adbc1e76e3133b
SHA1 b2a5fa4cea8ec18bb85173e73bbeeb14f38b520d
SHA512 f0347c92246ab57615db205876cf0a47f61eddd39d42f31dc7c1539e39dbf6661b56d8243f4a9e9cb4be27da7220de9410a60f6d3daae35c5d1338d226e0fa3d
TLSH
T10701A7CF853AEC4A0EA3114F2628535892986105C025F3663C795F158EECC6ACF21B7D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\te\messages.json
Size 796B
SHA256 40c84d74e36686384d7adec3363be5b0e5a87809acae39432eddfdbc62e7dbd4
MD5 a0ead22551e4d6537be2c8dcafd8520f
SHA1 17a6028903b2fdc3fc74665b27d193530ab5ac95
SHA512 10853f346111d2b02e1e350a7251f6e387139bdb7cb100bc80f4c9d14716e5d0a9803424fb09659606e323fce63c7a275fb0352b99b47b9466f0f971f0a292d1
TLSH
T191014F017916E615A5E70233791CF55C86381BA112D2E32D3DAFE34BDF63D6A0853B16
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\th\messages.json
Size 666B
SHA256 b80044e94b480c10470c6edf5dd260bd46540493b526130d8b2a03ea8acab41f
MD5 ad1398dd03ed8129a9e5ba75186a3a24
SHA1 7d1d40e8959ad38747d34603367de7dddc2df362
SHA512 07fdf6c280aacd40b9a6b13397b570c5707262d35704cd6e5cb5e439c901ae069244ae00a5d195b5d1d8a7cee449cef5e4a11cc9d3da483631d9f104d853ce9a
TLSH
T17A0146636845DE1A39652A063938B2C4D2386F6A3F01F0C5384D114F8FF0F268412FE7
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\tr\messages.json
Size 422B
SHA256 b262410f023e09dff8b4d81d074b091a73eb394a1db13f13f2878aa0b4f3fa38
MD5 8dedca518325cbe36754fcd7f7aa7b0a
SHA1 040f4eadf5f8b586e26ade1e00a3e4dae592c551
SHA512 6fd983587a7cd9aad7ccbb207142b1aac9a58ffa065d2ec62ca35f80281905e543f8bf6a79a49aff172f3f8c2b828fe1568a580b5aefb7ba8e0e0ffc94169a65
TLSH
T19EE05500C552B86A92FE42123E68662DE6F517BA2000C806BDBD100E0F78AA24199F08
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\uk\messages.json
Size 571B
SHA256 0bfcebd61e9aaafc456589ce18b73af1fb1d933406bb6f11e2f765c1e3d31f12
MD5 79126e4233f7245fd9af4fea368f3153
SHA1 ef7b0015dd869a9397f4339d2e88e41c81f4c433
SHA512 b81f0276f8f9b7060a906c94ca30cfa08669552016cc989b03dadd1d045854919a88081d725ac670901a7d7b64cc0b6c083748747df848271acfa4e88560e340
TLSH
T113F0221A8818ACBB016BC267F8A07500B5B406F9A601962B7E7C78AE0EF14618870F1C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\vi\messages.json
Size 479B
SHA256 879d1c47b51ea4bba46e72a57d129331ed3b71cb6a8d545fcf5ee73a2d240840
MD5 692be263e8a1136a0bdb3157a1223ad3
SHA1 a7cbd45f4a8031af08b820e7578eae5075796b8c
SHA512 4967b1b80d29299e50ef0c6242a1bfb05dfd2318ffd0960522f3a3803d86f40a9fa8b376e96766e452d884269735484af9baf54ca20de1ab7483d5e22615dc7e
TLSH
T174F0970699C0FA1702B1070AA9A53009FBE69A2B1040E95D7EEC203C0F70AA78812F18
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\zh_CN\messages.json
Size 379B
SHA256 7fd0ceac426fbff6088de114f2e1a238f2d6842de027217525096c674cb17e72
MD5 e5f4266d3c3ce307cedfff4323c16c0e
SHA1 900c305fb6f820bc15c2af61234415841596c5d6
SHA512 8fe6fccf5857ab6137100ed785b3293d9156e454d79598ed5b2af138380b7e4c81d3e13a4834d0e8f9f177f0a03e23efaae1c0af57c8fef8c1210572424416b4
TLSH
T177E06806D580EDAF05F6834538B87328D63A076A2804D4097EBE404CCFBCEA24492B5C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\_locales\zh_TW\messages.json
Size 379B
SHA256 25f70a0f5f7f5267b0ee8cd52e233f4b69f82d9cb46a3dc24c169ce4627f5841
MD5 6ae45053d9a60f496dc9708341d31ee6
SHA1 504495f6a0e102d5ad50b50ca79a526fcfe744f3
SHA512 04544b81b09dcf64a0f8b9f58b8a113cc65a93a46c83e71285c48df12a49d06b436c3f112637086654480aa8d33c509ebc9076949387069567e516a60cca0b73
TLSH
T1D2E0C014C450FD6F02B983417C657209C538477F4400808E7EEE808C8FB4D3389D2718
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\background.js
Size 264B
SHA256 1eed9d8fb6eb9f836709c8f0866ffa71fd5de7b9df7d1e8da1bb9c2011196e45
MD5 905169fc42d79ae27d1b2447eca46853
SHA1 97f991c3bb4dff09d2b3b4420bcb3f1540158886
SHA512 fa404104021c12b74a1f93e80e64c66069fd1efd88a1d0e93c36e49605994526b7a36b6cf3584cb72b214b718446e4f3f0c8e7970fd3f18c2b8025e1422dd29a
TLSH
T17AD05BC764A7080CD1C026D57E3176D12910B0BB3779B2369D5CE5E657B21CC5805755
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\icon.png
Size 5KB
SHA256 f355f2b3167c6c63bb570444d5e2db91f08a6903339a48f30e9d8eba233396e5
MD5 e9c36eed403d6c53a0c8fbe8c500168e
SHA1 4505e8496180ab4bbdf9630e05c9ec125ce9f46b
SHA512 66c1fb0e64218a92b6a66931f73012388563ca409593c20eb9a0c01f2fbf11f483c0b8450072f8a4cbd066e8bc37f874e20e07423d1db3f1c1f30aa23dfd6691
SSDEEP 96:FL+YbiMTorokHOfbaaLOdF/TgaPSfxpPteajY3QQhZByY6a:FCYboZufxkxTgaPeft9oXByY1
TLSH
T1D9B12D45EDF29BF35940ACAB075491FC2E20EB0C9A21512E8D6549CEAE14AACFDFD064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

frag.wgsl

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\source\shaders\frag.wgsl
Size 3KB
SHA256 a02382715dd48479a3a25186bdf3ccd41279a8ee476d9071ba9212951933a3c4
MD5 1a39ddbe254bdc23f784ab6b1c059eb2
SHA1 cff17b97381812463f12cbeb94067a12e8f0d768
SHA512 fb73952a0a0716156bdb396430fba4fb778620b4e4ab6dea36be96b305479ab81ec2c41e43f11da72d4e1deaf514d053eb528094a6de40a14f71923c5f9ab450
TLSH
T11D511145D6A210242697E1C20776B004265E97AF6E8DEC4CBC1EC3101F926AC9FF97E9
MD5 SHA1 SHA512 TLSH

Submit Download

vert.wgsl

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\source\shaders\vert.wgsl
Size 332B
SHA256 2cc3a249276241a39f3b82904d56a64ffa9b6eafb0b95385f5a2442f24ce15f7
MD5 9ed837b532515300ca481512d30d419c
SHA1 3d4275f00626ef084e06eb8117b76896dd331fb1
SHA512 489951d7c8f12821c02c4b149d94a386aa1f1468abb642f0531ac4dfc76e51c7f079ffc2af068e3bb36206af029834b0fe971fe08ac190286d4c3630366bec1b
TLSH
T111E0268008B589606853F383B4A0028AE27D583A6C2CCF09202EAD2137C3A8983274EC
MD5 SHA1 SHA512 TLSH

Submit Download

mainTex.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\source\textures\mainTex.png
Size 139KB
SHA256 05e915df1184ec1e9f3e6dcb264d25095046b04bcbc8606b3bac61f8e826cb8f
MD5 820f969d0629ff46a6151643f45c7a96
SHA1 b2dc36787ade5976588979d83446ae9bbe7b420e
SHA512 e02887e857a73959d9e88deaa1c219ce67cdac0a73f96cc8eb22e010e4945ec7617fa2654aa5293eb708cf0fb31a8eabddf92902d5606cdf7f0b5c9a4f0f8e63
SSDEEP 3072:xEzbJeHgig0ss3R2ODOh50nRVwLRNqe/GD46xe43or36dlgAi:x8le/g0ssUfh50nMlIBDzNYzXAi
TLSH
T171D31273C270CD5C05641FAD66B93C189BAC285073068C1A1D9E7EA78BB955F4CF68CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secTex.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\source\textures\secTex.png
Size 137KB
SHA256 6a7c66eef9773ec113aca4d5cd64f3f3aa49d4c534dc14fa985d707396223f2e
MD5 a5d49064c5862d0d25882705278fa92f
SHA1 978509537d486ff616e46fe21d9af21c82154e8d
SHA512 e39d61f9c24e5a3a5327b04cfdca7174b0f0237b901e2e0e34807d749fc7a340a6eb54a241fb90ab45afc99d30f852aecb572f683f76e42f3d30bb75f6e793d9
SSDEEP 3072:TAJvAhBFap+6SclcvHXDtxhYtjr9wWRDQ+Qh/g50xxG8Lp+PqDTvLdU:THBg+DzpYtjrBvmg5UcPq/v+
TLSH
T1F8D313C03D705E3464F1C31A5C6976339B6190AAED1970C8E4A4FA8F05977C25E9DB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preview.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir5964_1540630750\CRX_INSTALL\wallpaper\preview.png
Size 464KB
SHA256 c5a2b18b255c6a4029de97ef9d00af6e563b562a2abdbee1e934ff77d5a92c29
MD5 b22722b42e8b196c0e26ab8a8c6508c8
SHA1 2c4de3caa4409a164e31837f6bbf54c99d922c85
SHA512 a0904204f795dc7cdc6612867a87f60cbd27d1edbc70007e1fe5c4dfe83165ca287aed3319409a0829815e5175480e085775a9a3285d1d20d629b28641fddc99
SSDEEP 12288:lrGu17lQ0NW4Lwq23Po85e16slc0hyKQuhZSAS2T9PPdHNCPsOP83JDxj54:lrxvw73H521IKxh9S2TVPdHNwYDxN4
TLSH
T1A4A423E043F7207FC6678D44F640C86E15ACF52ED99C58CBEBEB401541AB8A4ED1C6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.7_0\main.js
Size 46KB
SHA256 e1b3123f37dfe988a8a22427e98d06cdf472c23429f6277f68c6eeb1626cd54e
MD5 3a4b577e6f2150e055d503fc17aec243
SHA1 6ab613cb92850a343caf28887301748c73b34722
SHA512 d4fb08f3423ddb5501e2d50c4b3c6cec5be34c9b149d469074119b144fa54a317199f485a8dc7eb650fa7762a0be79b49a2d99b4cbe9dd8408a632baf0cb2537
SSDEEP 768:DvKIO8ifSEWA5W847cy/FWpoMz908/lK85aipQqkUlVZm5Kdnr4WavCiwdC51SqJ:un8VEbWXxYNG8/A85DQqkslr4JPmCHLn
TLSH
T1F22328996269687E0BC2D2ED925D1313952460F8680D84AC723CDFDE6A0FDC2127CFF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_128.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.7_0\icons\logo_128.png
Size 7KB
SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
MD5 8723b83f007f8c910ae071e275f99383
SHA1 9f76b6719f4dc7ce2ae4ce96a8577481735f1ecc
SHA512 62256dd55be00b1a70e9afc127ba2079fbd563274c6829739f99fd02c6bcd2b2afa21337d8f58a7d64a716f41c0d739ab7b8f78058255bc1b59450eb0d0bdf4d
SSDEEP 192:mbNUdF2i9HsyhJ589/J6sdWQG1i+5pqG/LzPYehuNBpDxw:TfLeyh09/J6sdWL1AUvfhOm
TLSH
T1B8F19E690531CCD4B5B99F755309C0DE2136CA98A431AAAEE0CCF1CC3C573697ACCAE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_16.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.7_0\icons\logo_16.png
Size 653B
SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
MD5 e4fe7d0c1c77bb00d492bf59196fe3d3
SHA1 350335cd55b2acb2b8957cb79257375513b525f1
SHA512 73b6ed04cc5b46d700bf34bce51f50b19c89e9310053a473f577516a270b4ff7ff1ce954c18430c2625439bffed6153997a08d1aa6d3a4196b4ae5ad4089d556
TLSH
T135F0839A772C8958E9DC5C30B21F4297EA8C22E8C8431601A33F52313E63812138F08B
MD5 SHA1 SHA512 TLSH

Submit Download

logo_32.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.7_0\icons\logo_32.png
Size 1KB
SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
MD5 3e4cddaa76d8fcd9ac7b64fef89d4b74
SHA1 3a44b23b9b8f950f9168361da56cf8f86958a408
SHA512 9a6317ed1b9e919b3a6e3fd260f88b297b82498d294d7c86d1a40c20c35003694865f06632d1bf281417418b48122b4e01296e17318f7fe77612b3a716417bb0
TLSH
T1F221D8DF8464ED2E8531C8B3C14354E5E2BE94B3E47B9479F06BD8510C307958783E50
MD5 SHA1 SHA512 TLSH

Submit Download

logo_48.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.7_0\icons\logo_48.png
Size 2KB
SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
MD5 1a3f93acc11338a092785da97956c034
SHA1 ed1786563e53ad2fc076edabd25accb4ef241540
SHA512 7ff3c3eb9b7e55e799bc8c8ca66225fff47c52d85e1326f99b2e7c1747624462231e8dc9c09cc4d6e675d072d8da41ea998f16a4576de76c6575cda271255e85
TLSH
T143414AB201335E202C334219CA7203E2A80CADB0C02A7E91E0CCDBBACB00DE5E2DF506
MD5 SHA1 SHA512 TLSH

Submit Download

logo_64.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.7_0\icons\logo_64.png
Size 2KB
SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
MD5 9c3af737a428dd3daa949313d69be52f
SHA1 c24aa988066fbbc4da252b858fa738e20cc42c07
SHA512 ed9f869b3912eb8bf27624185c3ce648b5a586576deb7b1f9a0b6770fde1109a81fdb771a76f0902913c55aef7b6020f386dbd92a06c7ae106ca5fd593295c0d
TLSH
T129515D9D4EA1ECB15A2B46339AF935EBC5F0B37A0B2C277D60C94437A9C255231214E2
MD5 SHA1 SHA512 TLSH

Submit Download

service-worker-loader.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.7_0\service-worker-loader.js
Size 49B
SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
MD5 4924ae3164cb599ef50e43d008a34cd5
SHA1 09ba9cc17180bfa2c2edeb3ee367dc545a1fdd3d
SHA512 2adfafd18927c17fb11b0c7834a99fb4df50ff5f97873f424bbcff392cabdbbfb8f2d984575e293a531be14a602ed090ef2c348717f090a5de851d8818c344b9
MD5 SHA1 SHA512

Submit Download

favicon_opera_one.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.61.0.1_0\favicon_opera_one.png
Size 2KB
SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
MD5 723cf51fae375f557b2f891a2ea603ef
SHA1 40f374149ae6f8f5b847be59ba019744c232ebd5
SHA512 d0f64a88cf62642adf30af333f81481f43fd2141c63a135162152d1c7fa705b52121cac69edab0f93d35cc425b43fb6d6af2adc4323e5ad8e11109a423ff6eaa
TLSH
T1D4411A8324F7F9A0FE30E5AF1353E0454E655B9E2B512738128D08B4A4BA6DE92D202F
MD5 SHA1 SHA512 TLSH

Submit Download

reader_mode.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.61.0.1_0\reader_mode.js
Size 112KB
SHA256 af8a91b24637088da1f46285c17f1697365edd15d3e70553b2c1f33a138400b0
MD5 87cdc6ad0b081e4abeaebdee1b114aa5
SHA1 3c86836531d98c260b24f938bd973de12b81b9bf
SHA512 736971984111c1325a0b22f46c4425f6dfae6bd7986ea442d95a4fc90af126f11ac7166db9dbcbb7ced0fd5f88f1e0fb2e5c8c91d3aa36fcbf5c83384cc406bd
SSDEEP 3072:Ska6rka6zxszmxnS9lbv93NddM3prX+wH:Ska6rka6zxsqxGj3He3LH
TLSH
T16DB3D9ADB3927199928320E502FB0047E3355D451C1A5038F669E5DFBC24AAA62FFF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spotify_frame_interceptor.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.61.0.1_0\spotify_frame_interceptor.js
Size 5KB
SHA256 e81ab12e6c536f8c9d64a76be92fcdb63111d241d96974f0472d6751a6f7e3aa
MD5 f1f2074dd600d749c74870300f600838
SHA1 1059586c927cdd19dec0dd61d006edb635400381
SHA512 2f7d015c0a033b2476d2a20634dab8130b4830325d14899adcdec8454aa68ea9dbb7ff02d0444b922a24a2a91ee77673dcb36805ced83b5f40d796a359ecc68e
SSDEEP 96:xSVa6rQaSVa69J938bo5bYe3m/I6FScpoV9FzKovz1fFUAJxuis1Z1TTta12Ho6z:xka6rka69J93805se3m4XFzVJFsL1wxA
TLSH
T181B1A301819C4C7D8FB5029A9ABE135202DE6287786BD4C4EFA3C47597353CE9213BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\background.js
Size 86KB
SHA256 bc24cb72eda19eaf9ee195f014bd6247e826cc594e73461b826c6bd0d5f50dce
MD5 c8b19bb6ffa9ba9d07b010ee2483d6fe
SHA1 db1af85512d439f749c1fd64fa8f7dfbbe5f682e
SHA512 841d08ad1dfd23a85b3749dcec341c665457e0648509821ac140fe0ed753e8b0ea4a24e7b6ea5f06958f4ddb0b65f7e58250b783eea11c321fb975fbea63db46
SSDEEP 1536:PYHgfauhQ7F7yEPlL65+aSWr0WUvpyiSBwhmSvGj1S+f8+:PYAiuhQOokiSBwhmSvGZS+f8+
TLSH
T1969308CDB6C7F26293E390AAC03F101FF23A6D19740D4454B626DDD1782658EA236F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon_Light_Neutral.png

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\icons\128\Icon_Light_Neutral.png
Size 2KB
SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
MD5 bf24b39c7ecacb4ce180d5013d771066
SHA1 8b05f38ef028f9a6ca5411dcbc347d6672c252a7
SHA512 2398ba9b4216289bb2de142d614f312585f1e14e759d211ca169e1e54248761a78585f8ffd0de5f9112ebb349140f0346994b8a52a290ae22768a80d19cd8a9b
TLSH
T158515DCD26176426C397F654D206052A4F0841A72EDBF6E949306CEF9C53E0FD6DD760
MD5 SHA1 SHA512 TLSH

Submit Download

popup.js.LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\popup.js.LICENSE.txt
Size 1KB
SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
MD5 56868fb04ec3f6436a450b0be0c49947
SHA1 3114eed847366239e1b72b45af410bfba81bde4b
SHA512 a2211ab99b6d04b7f0a7c5dddeb8156c7c24e8ff0b2860cbddb6273d25089c7e066ea6be363a610553ee2b275ba4f7750f9456b30251000596544330d8262dc7
TLSH
T1CA215B5A35F53633026149A2670793CEAB0C11EEA4BF347BC4918374AC344FE8394DB4
MD5 SHA1 SHA512 TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.11_0\rules.json
Size 839B
SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
MD5 112b4a4c6143b507605be0de6f359ff2
SHA1 4ad368eac9b4965eb0389d2da4b2723016c8c69b
SHA512 9afaf96cfcde9688664d33f37168b9c637e414c3fb768b0c70cdb19cefcb42089e8f464a8d32bcc21a140414c0557fbc02c12a29a5eb662405d55ef7f1781b2f
TLSH
T19301B567C4255C230342217CE42B0719F970E14B6E646E2F3F9D845EAF5E47EAA7238E
MD5 SHA1 SHA512 TLSH

Submit Download

7164e78f-e603-44da-a2a2-1d672e3d5310.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\7164e78f-e603-44da-a2a2-1d672e3d5310.tmp
Size 27KB
SHA256 b8f0a6164e126d0f70798a96f456487080b5473bee571bb9594600f8a53901c7
MD5 c7828175f89c5a3ada16fc7817c80af8
SHA1 e6e6f4dd36fb419cb311093dadf8acb61db1d30e
SHA512 b68e7b8c42c6d571487841ad41148f7452e970b295516fe025744f7bbc8d0d7986699b41d5f71a6b43fd4ac28b6a216e24c19820ab01817c4bcfd50677fe7541
SSDEEP 384:OwU2+wy7Pxdr6zfM1dGSwrI7dG91rfprU87MJzeax:f1+V7jrI7IeywMoy
TLSH
T15EC21EE360CA08D9FFDF25F155861ACBD09BBB774A262178138363A5D3E4D20D5ABB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c337544-2a4a-4f8e-87fe-15e6e73177a7.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\7c337544-2a4a-4f8e-87fe-15e6e73177a7.tmp
Size 27KB
SHA256 aaa2c3089c7623aefb9025744747ec651dfa14d9decbe63ce941785b4202f1e6
MD5 1f17cac9ff7b6851ed5bc95c2625596e
SHA1 1a2f1ff883d5110a96e252b88784a00789e88add
SHA512 87539de5cb743b9823566a3c9bdfa8e43c4d78db761b40215e3483a8e0e155af22f057c4de290d9343459ba44a5a5cefacd53aa4fdaf032ee16f88e7039157cc
SSDEEP 768:+IsX2btgY8GIZbTbg4wjs2W0dWvlSNqv:+X2btg3vZPV60
TLSH
T117C2D773FF4CB61EC5C832B4C04A874561AFBF8C61725607B97C7E997B4E0438856A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

900239f3-2037-481a-abae-5a7bc26f23d5.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\900239f3-2037-481a-abae-5a7bc26f23d5.tmp
Size 27KB
SHA256 1b6cb01715a2de1373f9f3e194921621463532558767bb5d6e1902e9b368ca5c
MD5 20592c0bbc8cff757ec1ba508ee277bf
SHA1 7465050f95649e3bf662ebad10de27a9bef6a3dd
SHA512 c50dc6adc0aa4f0b80bfcc9bfa774c5d1a14e1cd3e889c924d3bfdcfa16c96b34f80dfdadde662ed87c0f33b37f59eaa151706e949641a24104c3583fc962cbc
SSDEEP 768:1VUpNy4heVwCSvh97oYHSI4R7VIO8BkM8s:3UpNy4heVwCSvh97zHSR7VIO8BN8s
TLSH
T149C2FFC2C8C54658EDA95F3460770D3D466BBFB9FEB8B54E8A8CB0717BB32C20426546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad18e16f-3097-41e0-b877-928101be6da3.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\ad18e16f-3097-41e0-b877-928101be6da3.tmp
Size 27KB
SHA256 1c2d3bd473e1870389f6737747a94d5e852790d686cf91b5e22ad83b190eefa3
MD5 ee77c4eb6b9e8b98db1acf41ba32c064
SHA1 c44316ff0f61c9a7f27f72bc31925ab992de4f6f
SHA512 ac0d2ae2afeeb0d82f75e86af6580c804c53abe3701734c7ad5e34bdfa4aa9144fc293a4c3d32207d3f0c70b9e3744ed8bee09cfbf96dc8ac825734537d04818
SSDEEP 768:90haQ3glH/EKEi+B4MfgL2BYb8Ohg70q6XnKa9UgEUjJY99yVnX3akrtSX:90haQ3glH/1Ei+B4MfgL2Bo8Ohg70q6m
TLSH
T1DEC286C2D8C00264EC592F75257B1D39112BBFBABDB8B24DDE4DB1757BB32D24126A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2d8b527-0aa2-4c00-9e9c-8200b3a07055.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\e2d8b527-0aa2-4c00-9e9c-8200b3a07055.tmp
Size 27KB
SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
MD5 dd8e6df155a2ff5f53f81679d8701c70
SHA1 392045fa8c2bbc94b569ea3a70068c8dc8d34826
SHA512 bb1b9a80f15288056a5792ab509451e841c7ad7b654fa7bd5b862bdf298ea8421c201b237d9cb4f0b64d46c40d0bbbc229161730eca3d5d957e12be515764145
SSDEEP 768:eF2AR0FEDVua3n5F5chXL3tbF/a0YFFle/Y:jFFC1qL3rYFFleQ
TLSH
T1D2C2A85294CBFA07C379F6734ADA0DBBC3B38D0BAD904664D2E8B47CD8B92845D045AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9453f35-4ea4-4978-82bf-fe34618ec464.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\e9453f35-4ea4-4978-82bf-fe34618ec464.tmp
Size 27KB
SHA256 3a9c655a88437e331f50a23bb40cb1a3de86277cb1a9488c81c426598cfab0a3
MD5 0ce5874c8dd17ed15835bd7995b1dedb
SHA1 5598cb802a08f2c2db0e8336cc2662f81227a3f6
SHA512 a5d97c7608d92285288b3da804b73f1ccf5987a46aa635a9321fd5b6cebdf4f80e302310c5524e63301fc4c7b222c98dc5ccf8094dea369ed3408657079c6495
SSDEEP 384:Oi11a11N+CLD9mj7F/dMN0ADl+bRqg+T3jbp+wHL:P11a113D9G7LMN0lb4rPbp+wr
TLSH
T144C288E1E8589F24D65C3836C2BB9C4986ACBD3D1929410FB663BD00B9EFA0CD5C2F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
Size 1KB
SHA256 530c484d9afdddf662350a077b8a2344937d729753bf81f22536e9a9d4e65684
MD5 ed830a90b7c25806976c3158bf1a9287
SHA1 68eb0bb75e05b43352bad27bab922a86508e27ee
SHA512 5a48709db702c7ec4d1a9c29f0d956dfd59742b1897ebbcf607966a970717cb68ac0ca7ebfd1de47b5b9c9bb0832343ca2a696fa83c0ee099fe875da8173f158
TLSH
T1DC213AF753746A7D9B11C2F0E918AF1F8E9D1412839C79BA86E06E1393B3961F100B0B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

a8d9b125-65cc-41bc-85d5-9cace6c8cd75.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\a8d9b125-65cc-41bc-85d5-9cace6c8cd75.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c85af21e-e928-4400-8b15-8e7c80bc9bfc.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\c85af21e-e928-4400-8b15-8e7c80bc9bfc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 16KB
SHA256 b853a163c6dadc62ee5346be79a7b1352246ffd209763b78b10de79a4a94dbad
MD5 ac70b551f745369b12b87165f4787f3f
SHA1 1a3151ab853b118336996d073b6ed61b665ba5a4
SHA512 26be97b9b3b7deb1bd6a80396b009f39b2ca57204c3f8cb90d3fa1612d7911f3802cd759b72084492479722bdd0e7b0f8f641863f338d0d821668dbda2673228
SSDEEP 384:QjmQlmjFIm0Xq5YIoVdQEGtOwaIvMOU68Ufi9b0WkihLRSkxPj:QjmEXXYGPPj
TLSH
T117725646A4245EBA05CA6929B950F33BF3E80016D2537D95BBF9C82C00CF2DD6916DCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 11KB
SHA256 ab80f870372f271256a1c3ec74772e984d3461131a657ca704a5148b0eaaeb65
MD5 03db799355f65ee0e995d82dacd4d3e4
SHA1 4ba008bedd3c678726954c06ae57d866d8e8ca23
SHA512 acd09d1db6e472844033ad06fab343a80b67da212085b3c9952c485d4ff559c12f4f11f125aedbc9f4d2266be401c52004ae3da1c5d5b51a94e71d95badae034
SSDEEP 192:hE0J9qNQXDXPWyXeLXoX0XMXhXaXKXqXNX1XyXGXIXFXwXSX8XKX/XBwXwXWXcXL:joAjFIm0Xq5YIoVdQEGtOwaIvMOU68UL
TLSH
T16A32234A95285DBB0CC66925FE10B667F3E80012A1577D94BBF9C82C05CF2DC69279CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 15KB
SHA256 785aa06da2b54dda85f3ee70e562d5c7c0e8cd01fb961583e6c906124b418e24
MD5 5f85c70727be8f0fd46ad9f1930c7637
SHA1 3c72492790d4cac17121c86d919ceba7354b379b
SHA512 528a718f9c110880855abe022e61c38d12d9ebd66598ea449730f6f90e2c13db7dba550b162aefa2394108e48c5067c9f6cd3e7558ac77a50e1c1edd681aa4c6
SSDEEP 384:7/0lmjFIm0Xq5YIoVdQEGtOwaIvMOU68Ufi9b0WkihKRSbxPj:7/QXXYnqPj
TLSH
T16E724646A4345EBA05CA6929BA50B33BF3E80016D2537D95BBF9C82C00CF1DD6916DCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
Size 15KB
SHA256 692cb2405e3578ba4aa6f9c60ab1cbb54d8730058cc2963a9763eb5b320b4680
MD5 ccebdd17820b9dcfecc9aadc1a8512a3
SHA1 494d47909d3e6628f9628367969990d13c2edceb
SHA512 339f2ac99d92eace4da5c519460d497242bc24799b6ae3f1589f746a91e190ecbeacfc52eae38731f53762ae85004b3959d487eaf6620937de441dfaa2e80d8c
SSDEEP 384:7oolmjFIm0Xq5YIoVdQEGtOwaIvMOU68Ufi9b0WkihKRyMbxPj:7oMXXYnI+Pj
TLSH
T19E726646A4345EBA05CA6929BA50B33BF3E80016D2537D95BBF9C82C00CF2DD6916DCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
Size 116KB
SHA256 0cab7a51208d26da5bd1feb56b7fb5936d8999d26a9077c4617cfd6edac6acee
MD5 a5ea9f11a7b3e750148bd3fc7315a07c
SHA1 ce29ce0ffc4f6327c3369ba9042214b18420ce7c
SHA512 a9707a2f64048498885ba0a540f7869c636bc2e579b93f74dd04cd247b599c7d4506ff0b830bb08273b5fc2638f9a4b1fc79f5c6e3c644c8a917e6ea24a4184a
SSDEEP 1536:XEYwsS9ds8JaqFS4HR6YCSkAhSwJSZ5EXS8uUSw4SYI2S58jHoS1QSih5CS2Ckv4:XEYwfdsI7MA5Pr/852shP2AIxgGj2tuZ
TLSH
T198C3F9A6CCCD9E758ED88BF8DC36AB1B98980155AF9C5F14A7FA404C03C5789213F58B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
Size 91KB
SHA256 59462d5d831543cc24738f936a61fb1f25c5d75651b9019f9a30a3e8ccb403f2
MD5 b0e4b75216b3263190fec32dfdce2b10
SHA1 89eddc3d53ff051febdc0e80a36e1c3ef5d4c564
SHA512 cd2f20e974587fc391e834aa8805eaceac99036b6e6828048ccdc2b0dedcd55fceac64feccf15ee8c4e7c23a836acb166ab751adbdef556c077bcf41f95a6692
SSDEEP 1536:8S4HR6Y3SkAhSwJSZ5EXS8uUSw4SYI2SUS1QSih5CS2CkvocXTRSGS7sObp3HV8B:sA5PrcpshP2AIxgGLXW
TLSH
T16193E9A6CCCD9F758FC88BB8DC36A71B999400499BDC9E14A7FA404C43C6785253F28B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
Size 91KB
SHA256 ecb35528134827678d88820efea7d08379b0573c8ef0653131c38f653a30d744
MD5 2615af87687dfd173f599344f9061af6
SHA1 8e14dd6f231d355df15f95be319ee0bc5a7d8bb0
SHA512 503c0b2ae65d5990a150a530a65b6e9faf2c8844cbd5a090b112bfd5a783c9fe0e13ed73adffd93e34224a4786812a274ab2dba05e8d58f2f57a8d1dca1b0ea7
SSDEEP 1536:TS4HR6YCSkAhSwJSZ5EXS8uUSw4SYI2SUS1QSih5CS2CkvocXTRSGS7sObp3HV8R:CA5PrcpshP2AIxgGXhch
TLSH
T1C493D8A6CCCD9F758FD88BB8DC366717999400499BEC9E14A7FA804C03C6785253F68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ba648b2-dacc-4722-bb43-47dcc281031a.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\5ba648b2-dacc-4722-bb43-47dcc281031a.tmp
Size 72B
SHA256 172883f38a03631b069181a06d930b50d773c9d742ec33aba4498c78dfcbb90d
MD5 b8c14cf3ed7a4e362f485b19c215e378
SHA1 6bea1ac4ce1a45eeb7135391813312aeb0a2206b
SHA512 4cc3686f75d8008481bd39ae2a1d3aad5f8a881fc95006907101b1dc035039af7c2bc5f6e08e929569a6fe00c1b3f250178471161a8dd6c7fee668286bad570c
TLSH
T1A7A002250290C15AC50502B46801C3C89204BE2591400213B7D143568C71096591115A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 360B
SHA256 b620e3ffbe6ca62e3049063bd3a2e0837bd6d40800f6c0e9b2e71a8a587aef83
MD5 f18eaa5a3801dc183042b2555b09b8f1
SHA1 6de41c1976639da844545a170921d12437dc83af
SHA512 27d5b7d8bb6bf5b457ae5e4478cd938476ef6e853a2f44bbfca3c1ddda335986b40aeaf936dc07dd7e9134820d74b8e9358c843f7ce27c5d3095232cfa66c170
TLSH
T1B7E0A712970E208FD4A5E374399B05963732C7A7DA1963CF4254227DCCC63720E53444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3c570ef246f16b31d61bee2684270ef7466103e3b6785898a3793b97333de6d9
MD5 1ee28f44a4f343ef19fcc0e0ef39b5d4
SHA1 923b538370ff1654d3af5120be0534ff3510d776
SHA512 03012a5c473952ac9ca19708bdaa88f989a2eadb7ddaf363e3023094a333cf6952929495696958b15512baf438d0a632f4ca74e3764924a9b098abcaac4d0db5
TLSH
T123B01214840E3122C44003F0720544881320DF1DC9820347866042758C621711145000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 216B
SHA256 235027c3c0667d29e3e6f657b3f5b1db090530449358c3a14f0101d7255b8c02
MD5 d9d3c4acb98e101e31bf047a64ee8613
SHA1 f4a054ca8f085e64b3f63bfb8821bb13fe9db540
SHA512 86907923634cbb35a827064745a72a3841819db9dac1503bdea3c02ae2c2afd8613be89c6b11b6a8ef5fc0a8d55c84f875c17c19885a6ea549b60d2298489af5
TLSH
T139D02B039A0D21C8C0B803F47A0744EC0334FB70D81123960130517B4CF51320DDB447
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

7c2ea868-edcf-41b2-b3f6-8c304f0dd8fd.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\7c2ea868-edcf-41b2-b3f6-8c304f0dd8fd.tmp
Size 381B
SHA256 9623b2e79022b7f2f8c46cb7fa18fff9ae87680a0b26a98858212fef1f2c9b74
MD5 d91ff270a29149dee3efa7c938d1e2e6
SHA1 c9a4bdbffa5a45f20011b49e4042b2d8bbb186f6
SHA512 371cbed0230bbd83556f3cfc06cdeca5cd47f83b1cf1be4700bd873ecf117e96551b7d885dae7149e518ab8320751b744bf840fef19d3ff04c637de5b0359acb
TLSH
T14DE0F19B0DD21D03129AF2B04D3619F240433348A8500771584B05534167E42BB68E07
MD5 SHA1 SHA512 TLSH

Submit Download

802cd885-4a0b-4e11-b92a-d28a583e385b.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\802cd885-4a0b-4e11-b92a-d28a583e385b.tmp
Size 381B
SHA256 5a3595346613b9ab2a2ebcadbba2b11ff5d160efad7182fbd4a72e2e7618178b
MD5 df3c3aec13f323394031bdd225ced81d
SHA1 8a35314953345ac31d690ca17e25758331feb18a
SHA512 bacd9a4130b74d5d11931efe27508c358466c2933b92e15ef9b889143ec18f9faa31c83922177dba9f213fe146424a6c7f7de47dafc33924b4f669146826965c
TLSH
T1B6E0F80C3A82063780840F82CF2B8C36DF84BF3ACB9D8B07328409D4E49430606EC66C
MD5 SHA1 SHA512 TLSH

Submit Download

cba27941-4722-4e58-b472-b0c59e50694e.tmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\cba27941-4722-4e58-b472-b0c59e50694e.tmp
Size 381B
SHA256 943c4ab17a4a89e517764d01839d4658ad3de7e040a3d6958ad25e3ae3b627ef
MD5 9c5e03eb88827539064385ac7316acb8
SHA1 19d87696fd6a42aa6978762c235f0544c4ae5108
SHA512 1851d2b344d89d431a7e35df47ab52d4ebaff51787dae0fa3dab3fd7b54ad3d06b3f38f8c8af90507e0ac36468e1f3f5c099f7994fdf336759ff6cce6e121d58
TLSH
T1DEE0F1E1696900A7042A91DECE85BFE277CF3194C846968F26013E7142008826050740
MD5 SHA1 SHA512 TLSH

Submit Download