Overview

overview

8

Static

static

3

Velocity E...41.exe

windows10-ltsc_2021-x64

8

Velocity E...41.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    30/09/2026, 05:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Velocity Exploit_74764841.exe
  • Size 702KB
  • Sample260930-gmd8bsysds
  • SHA256 74b57e66864831c686f2a1bb445c7ba2a4bd5d985aa9879e67bb8a7c847e04f5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 4 IoCs
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 7 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 55 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 55 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Velocity Exploit_74764841.exe
    "C:\Users\Admin\AppData\Local\Temp\Velocity Exploit_74764841.exe"
    1⤵
    • Downloads MZ/PE file
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\AppData\Local\OperaGX_74764841.exe
      C:\Users\Admin\AppData\Local\OperaGX_74764841.exe --silent --allusers=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe --silent --allusers=0 --server-tracking-blob=OWU1ZWQyOTQ4NGExOWJlNjg2MjNlOGMwNDdjMTIxYjE0OTVlNWJiYjZiZDBjZGJmZDJhYzZhN2RkMTE1MjI0Mzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPThmNDdkMzE5MDYxMDRmMDg4YThmMDE5ZGIwMzdhM2Y0IiwidGltZXN0YW1wIjoiMTc5MDc0Nzc2Mi4wMzcwIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiOGY0N2QzMTkwNjEwNGYwODhhOGYwMTlkYjAzN2EzZjQiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiIwODUzYTU0Yy1hYjI2LTQzNTktYWI1MS1mNGMwYWY2MjU5YmMifQ==
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Enumerates connected drives
        • Reads the TCP/IP host and domain name from the registry
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff74d797998,0x7ff74d7979a8,0x7ff74d7979b8
          4⤵
          • Executes dropped EXE
          PID:1848
        • C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\installer.exe" --version
          4⤵
          • Executes dropped EXE
          PID:2072
        • C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2104 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_20260930065602" --session-guid=559d2b28-c952-4557-beae-1d2ee1837605 --server-tracking-blob=MDY0ZjcwYzI5OTFjMDdlN2IwYmY3NzlhYzExOTVkMmFiZjExYjYxN2MyZTA3MTg3NTk2ZDlkYWUzYmFiYWJmNjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPThmNDdkMzE5MDYxMDRmMDg4YThmMDE5ZGIwMzdhM2Y0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkwNzQ3NzYyLjAzNzAiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiI4ZjQ3ZDMxOTA2MTA0ZjA4OGE4ZjAxOWRiMDM3YTNmNCIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjA4NTNhNTRjLWFiMjYtNDM1OS1hYjUxLWY0YzBhZjYyNTliYyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7C08000000000000
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Suspicious use of WriteProcessMemory
          PID:968
          • C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x288,0x28c,0x290,0x254,0x294,0x7ff74d797998,0x7ff74d7979a8,0x7ff74d7979b8
            5⤵
            • Executes dropped EXE
            PID:2652
          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --backend --initial-pid=2104 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021" --session-guid=559d2b28-c952-4557-beae-1d2ee1837605 --server-tracking-blob=MDY0ZjcwYzI5OTFjMDdlN2IwYmY3NzlhYzExOTVkMmFiZjExYjYxN2MyZTA3MTg3NTk2ZDlkYWUzYmFiYWJmNjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPThmNDdkMzE5MDYxMDRmMDg4YThmMDE5ZGIwMzdhM2Y0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkwNzQ3NzYyLjAzNzAiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiI4ZjQ3ZDMxOTA2MTA0ZjA4OGE4ZjAxOWRiMDM3YTNmNCIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjA4NTNhNTRjLWFiMjYtNDM1OS1hYjUxLWY0YzBhZjYyNTliYyJ9 --silent --desktopshortcut=1 --install-subfolder=136.0.6008.76
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:6120
            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6e8047998,0x7ff6e80479a8,0x7ff6e80479b8
              6⤵
              • Executes dropped EXE
              PID:5228
            • C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes a Windows system DLL name to a user directory
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Suspicious use of WriteProcessMemory
              PID:5868
              • C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0xefc9cc,0xefc9d8,0xefc9e4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:5884
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5964
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x5cc9cc,0x5cc9d8,0x5cc9e4
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5984
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:6040
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:6064
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x180,0x184,0x17c,0x14c,0x178,0x7ffded52ec30,0x7ffded52ec40,0x7ffded52ec50
                      10⤵
                      • Executes dropped EXE
                      PID:4508
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:5332
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x144,0x148,0x140,0x130,0x180,0x7ffded52ec30,0x7ffded52ec40,0x7ffded52ec50
                      10⤵
                      • Executes dropped EXE
                      PID:5560
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x268,0x26c,0x270,0x240,0x274,0xdf7324,0xdf7330,0xdf733c
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5644
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:2208
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x1b4,0x1b8,0x1b0,0x180,0x1ac,0x7ffded52ec30,0x7ffded52ec40,0x7ffded52ec50
                        11⤵
                        • Executes dropped EXE
                        PID:2488
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:5692
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x180,0x184,0x17c,0x14c,0x178,0x7ffded52ec30,0x7ffded52ec40,0x7ffded52ec50
                        11⤵
                        • Executes dropped EXE
                        PID:5768
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:5956
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x180,0x184,0x17c,0x14c,0x178,0x7ffded52ec30,0x7ffded52ec40,0x7ffded52ec50
                        11⤵
                        • Executes dropped EXE
                        PID:5336
            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:6104
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x144,0x148,0x150,0x140,0x13c,0x7ffded52ec30,0x7ffded52ec40,0x7ffded52ec50
                7⤵
                • Executes dropped EXE
                PID:1284
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1652,i,13430359199821498942,11746948929828128318,262144 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1928 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5380
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2176,i,18085420100763978159,2801729337950597073,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:3
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                PID:3472
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2472,i,6364336848407382986,8679920312952035487,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2664 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6156
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3192,i,12851707420314660649,631251957273793644,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3268 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6320
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3204,i,12772162693423269032,12993335427520799075,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3280 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6328
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3216,i,8054038481570235827,16809805324839950125,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3304 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6336
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3228,i,9372390516830026230,2704119411448101041,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3316 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6344
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3240,i,4725026122282834055,3399689460783458436,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3344 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6352
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3252,i,16106922593710166907,18160787239698861458,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3356 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6360
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3976,i,13014190683444730505,570735936415832241,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3988 /prefetch:1
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6392
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                7⤵
                • Executes dropped EXE
                PID:6368
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4724,i,17740072337159258113,11147302022477144610,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4744 /prefetch:1
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6632
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4916,i,2915162491296378466,10914259127938947183,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4960 /prefetch:2
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6708
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5104,i,13824885183203686352,2862785246571243973,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4964 /prefetch:1
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:6748
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5316,i,15915827130130435672,12141544192267356692,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5320 /prefetch:1
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6136
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5448,i,3325776694970405843,13615133221303390514,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5436 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:5384
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5452,i,3271253794588471727,4479035600630530471,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5432 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:5656
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5456,i,7755354863971416706,11472613710257174010,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5464 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:2780
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5460,i,7876822383444924201,10651871741094074174,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5584 /prefetch:8
                7⤵
                • Executes dropped EXE
                PID:5028
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6096,i,1795623616231362309,7870490144775551885,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6052 /prefetch:2
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6260
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6728,i,7235027826756386703,5241539540698095735,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5100 /prefetch:2
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:6808
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6888,i,10957777466649585857,2802346180714544598,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4748 /prefetch:1
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:7756
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6092,i,2694774349066126527,10156315997787873842,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=1376 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:8148
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6644,i,3420658008424310356,11339839929712755937,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7292 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:7704
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7432,i,7818623539050439236,17717542966540030794,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7444 /prefetch:8
                7⤵
                • Executes dropped EXE
                PID:7848
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7576,i,12449600098942764511,2768950295617095907,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7584 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:7892
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7600,i,10844996311047644266,3202170713451892469,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7720 /prefetch:8
                7⤵
                • Executes dropped EXE
                PID:5652
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7744,i,16072357235735892400,16493842198891004433,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7748 /prefetch:8
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:7540
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8036,i,15946210787600215586,12575572722720547709,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7784 /prefetch:8
                7⤵
                • Enumerates system info in registry
                PID:8012
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8176,i,848591633440783385,7752759705858460982,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7580 /prefetch:8
                7⤵
                • Enumerates system info in registry
                PID:8356
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8188,i,15087899464922051330,13867844827169662441,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8220 /prefetch:8
                7⤵
                • Enumerates system info in registry
                PID:8364
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8196,i,13383386042700591151,820872271837761455,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8240 /prefetch:8
                7⤵
                • Enumerates system info in registry
                PID:8372
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8208,i,12494238793594543779,8176645763755807747,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8276 /prefetch:8
                7⤵
                • Enumerates system info in registry
                PID:8380
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8752,i,14635686201741218074,3645712449848792410,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8760 /prefetch:8
                7⤵
                • Enumerates system info in registry
                PID:8416
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9312,i,12649090241292487408,6892943661424271667,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9328 /prefetch:8
                7⤵
                • Enumerates system info in registry
                PID:8512
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9468,i,9716160225660688427,17147358401893294527,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9476 /prefetch:8
                7⤵
                  PID:8608
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9640,i,4876646414579599041,3976127165638680461,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9644 /prefetch:2
                  7⤵
                  • Checks computer location settings
                  • Enumerates system info in registry
                  PID:8620
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9496,i,3875456214931883367,12365287315903522113,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9796 /prefetch:8
                  7⤵
                    PID:8636
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                    7⤵
                    • Reads the TCP/IP host and domain name from the registry
                    • Enumerates system info in registry
                    PID:7420
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff79f686598,0x7ff79f6865a8,0x7ff79f6865b8
                      8⤵
                        PID:7276
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10212,i,14200385688890878216,12475795922159858952,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=4028 /prefetch:8
                      7⤵
                      • Enumerates system info in registry
                      PID:8036
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10268,i,2620434917391199048,7994678991410597296,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10248 /prefetch:8
                      7⤵
                        PID:8668
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=10436,i,2629232001116125459,2826928648264020173,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10468 /prefetch:1
                        7⤵
                        • Checks computer location settings
                        • Enumerates system info in registry
                        PID:8772
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10392,i,7152501862156993772,4506675931191100619,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10596 /prefetch:8
                        7⤵
                        • Enumerates system info in registry
                        PID:8208
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --fix-taskbar-pins
                        7⤵
                          PID:8568
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6e8047998,0x7ff6e80479a8,0x7ff6e80479b8
                            8⤵
                              PID:8920
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3448,i,8417263715768570782,4421153814428377607,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10764 /prefetch:8
                            7⤵
                            • Enumerates system info in registry
                            PID:8588
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3264,i,535443922336428517,14356927996169110284,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10792 /prefetch:8
                            7⤵
                            • Enumerates system info in registry
                            PID:8732
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4080,i,15877612834612524585,8731240875696682746,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=8024 /prefetch:8
                            7⤵
                              PID:7480
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4040,i,9237359657902146594,10247908437848258451,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=4060 /prefetch:8
                              7⤵
                                PID:7244
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7572,i,6368644711466283526,6171784871312421195,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=10612 /prefetch:8
                                7⤵
                                  PID:7596
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10448,i,1533237260909122776,5250142359944619915,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=6136 /prefetch:8
                                  7⤵
                                  • Enumerates system info in registry
                                  PID:7520
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3324,i,14204366145372047502,18305745763793061740,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=4008 /prefetch:8
                                  7⤵
                                    PID:7456
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4076,i,9190030140314311894,6922492843784072854,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=3404 /prefetch:8
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:7668
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10776,i,15373929724651368456,11748356086114515918,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=10276 /prefetch:8
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:8204
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10260,i,11158125858885556191,13048786381973420192,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7980 /prefetch:8
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:8268
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7452,i,9313257362673653865,7131946145783995501,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=7420 /prefetch:8
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:8652
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8420,i,14946975969735804889,4821381048499947219,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=8484 /prefetch:8
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:8316
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9480,i,8581964926411075042,11416564605577776207,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=9580 /prefetch:8
                                    7⤵
                                      PID:8600
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8460,i,12023106969578475439,8778121485887820896,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=9356 /prefetch:8
                                      7⤵
                                      • Enumerates system info in registry
                                      PID:1028
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9388,i,8893356919134860674,17134504316294018026,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=9396 /prefetch:8
                                      7⤵
                                      • Enumerates system info in registry
                                      PID:2480
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9380,i,5053912178321790614,5197958608442429168,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=9324 /prefetch:8
                                      7⤵
                                      • Enumerates system info in registry
                                      PID:9160
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8300,i,15863339879530451684,533906823849406636,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=3336 /prefetch:2
                                      7⤵
                                      • Checks computer location settings
                                      • Enumerates system info in registry
                                      PID:7116
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7604,i,11064144891072757578,5013831402892381205,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=7692 /prefetch:8
                                      7⤵
                                        PID:8992
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7612,i,9159589652016043196,7383973515790833652,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=7644 /prefetch:8
                                        7⤵
                                        • Enumerates system info in registry
                                        PID:6368
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10372,i,2041043141550372446,528259911568835632,524288 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=7576 /prefetch:8
                                        7⤵
                                        • Enumerates system info in registry
                                        PID:6236
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=10908,i,6551886066841652493,12462990402392708046,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=4780 /prefetch:2
                                        7⤵
                                        • Checks computer location settings
                                        • Enumerates system info in registry
                                        PID:7892
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=3208,i,12079435476834838259,16634832043665688460,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=5728 /prefetch:2
                                        7⤵
                                        • Checks computer location settings
                                        PID:9116
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=8780,i,10579981748041080376,1894908557604314373,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=8244 /prefetch:2
                                        7⤵
                                        • Checks computer location settings
                                        • Enumerates system info in registry
                                        PID:8264
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=8164,i,15377788284955061265,2411995019152822080,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=9324 /prefetch:2
                                        7⤵
                                        • Checks computer location settings
                                        • Enumerates system info in registry
                                        PID:6672
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=8052,i,15295213714224941480,433593423159690695,2097152 --field-trial-handle=1932,i,9349751974138024388,14911328610371333044,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1936,i,2611335194882617797,18438338359854368203,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=8744 /prefetch:2
                                        7⤵
                                        • Checks computer location settings
                                        • Enumerates system info in registry
                                        PID:8776
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --edition=std-2 --host=https://autoupdate.opera.com/ --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera GX" --lang=en-US --pipeid --producttype --requesttype=shutdown --version=136.0.6008.76 --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --firstrunver=136.0.6008.76 --firstrunts=1790747821 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9
                                        7⤵
                                        • Reads the TCP/IP host and domain name from the registry
                                        PID:6832
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff79f686598,0x7ff79f6865a8,0x7ff79f6865b8
                                          8⤵
                                            PID:8464
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Writes a Windows system DLL name to a user directory
                                    • System Location Discovery: System Language Discovery
                                    PID:3792
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe" --version
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Enumerates system info in registry
                                    • Suspicious use of WriteProcessMemory
                                    PID:2544
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0xefc9cc,0xefc9d8,0xefc9e4
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:2092
                              • C:\Program Files\Booster\GameBooster.exe
                                "C:\Program Files\Booster\GameBooster.exe" install
                                2⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of WriteProcessMemory
                                PID:544
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\GameBooster_CreateStartupTask.ps1"
                                  3⤵
                                  • Enumerates connected drives
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4496
                              • C:\Users\Admin\AppData\Local\AIChat_74764841.exe
                                C:\Users\Admin\AppData\Local\AIChat_74764841.exe /S
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Reads the TCP/IP host and domain name from the registry
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4208
                                • C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                  "C:\Users\Admin\AppData\Local\aichat\aichat.exe" --hidden
                                  3⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Checks whether UAC is enabled
                                  • Reads the TCP/IP host and domain name from the registry
                                  • Modifies system certificate store
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of WriteProcessMemory
                                  PID:4228
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4228.1524.9103849369098573094
                                    4⤵
                                    • Drops file in Windows directory
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of WriteProcessMemory
                                    PID:4548
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe1405b078,0x7ffe1405b084,0x7ffe1405b090
                                      5⤵
                                        PID:936
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1804,i,11999580802324798985,967436206707565213,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
                                        5⤵
                                          PID:560
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2064,i,11999580802324798985,967436206707565213,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
                                          5⤵
                                            PID:4300
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2128,i,11999580802324798985,967436206707565213,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
                                            5⤵
                                              PID:2596
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3528,i,11999580802324798985,967436206707565213,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                                              5⤵
                                                PID:3296
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2376,i,11999580802324798985,967436206707565213,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
                                                5⤵
                                                  PID:6516
                                        • C:\Program Files\Booster\GameBooster.exe
                                          "C:\Program Files\Booster\GameBooster.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Reads the TCP/IP host and domain name from the registry
                                          • Modifies data under HKEY_USERS
                                          • Suspicious use of WriteProcessMemory
                                          PID:1700
                                          • C:\Program Files\Booster\GameBooster.exe
                                            "C:\Program Files\Booster\GameBooster.exe" --minimized
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:2420
                                        • C:\Windows\System32\rundll32.exe
                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                          1⤵
                                            PID:5636
                                          • C:\Windows\system32\wbem\unsecapp.exe
                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                            1⤵
                                              PID:7064
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of WriteProcessMemory
                                              PID:6216
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x180,0x184,0x17c,0xdc,0x178,0x7ffded52ec30,0x7ffded52ec40,0x7ffded52ec50
                                                2⤵
                                                • Executes dropped EXE
                                                PID:6220
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                              1⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              • Enumerates system info in registry
                                              PID:7472
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x274,0x278,0x27c,0x20c,0x280,0x7ff79f686598,0x7ff79f6865a8,0x7ff79f6865b8
                                                2⤵
                                                  PID:8400
                                                • C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe" --version
                                                  2⤵
                                                    PID:3068

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      1
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Hijack Execution Flow

                                                      1
                                                      T1574

                                                      DLL Search Order Hijacking

                                                      1
                                                      T1574.001

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Hijack Execution Flow

                                                      1
                                                      T1574

                                                      DLL Search Order Hijacking

                                                      1
                                                      T1574.001

                                                      Defense Evasion

                                                      Hijack Execution Flow

                                                      1
                                                      T1574

                                                      DLL Search Order Hijacking

                                                      1
                                                      T1574.001

                                                      Masquerading

                                                      1
                                                      T1036

                                                      Match Legitimate Name or Location

                                                      1
                                                      T1036.005

                                                      Modify Registry

                                                      3
                                                      T1112

                                                      Subvert Trust Controls

                                                      1
                                                      T1553

                                                      Install Root Certificate

                                                      1
                                                      T1553.004

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      1
                                                      T1552

                                                      Credentials In Files

                                                      1
                                                      T1552.001

                                                      Discovery

                                                      Network Share Discovery

                                                      1
                                                      T1135

                                                      Peripheral Device Discovery

                                                      1
                                                      T1120

                                                      Query Registry

                                                      6
                                                      T1012

                                                      System Information Discovery

                                                      6
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Network Configuration Discovery

                                                      1
                                                      T1016

                                                      System Time Discovery

                                                      1
                                                      T1124

                                                      Lateral Movement

                                                      Collection

                                                      Data from Local System

                                                      1
                                                      T1005

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      GameBooster.exe
                                                      • Path C:\Program Files\Booster\GameBooster.exe
                                                      • Size 715KB
                                                      • SHA256 3bf07d3bfa2cb446e0bcbe889647a0734ab0255edf6b7290ac4c3e9d2e667fef
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      hgsdk.dll
                                                      • Path C:\Program Files\Booster\hgsdk.dll
                                                      • Size 7.4MB
                                                      • SHA256 2720d215168108700767f8e9b57819d55ca139d69d8d828186da186850a37c6c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                      • Size 183KB
                                                      • SHA256 8c31a00f076834640ed444d3396e338b33cb67f3fca11f7822ab365e44258f8f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      A9FA314C8877B1FA1F912B4C18662AEE
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9FA314C8877B1FA1F912B4C18662AEE
                                                      • Size 281B
                                                      • SHA256 38dea488c2b4b0b239bbc28290e2b50ebc954ddeb7b36a7ffacaed5cf28bffc6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                      • Size 471B
                                                      • SHA256 f4c81da45da3889780c4e61596bdbc7544a9306861551a6634dae51963e36fd2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                      • Size 248B
                                                      • SHA256 749cde6969d71f4b5344723300cc8959c9e6183c17b4c3b55daf16ae08c5d845
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      A9FA314C8877B1FA1F912B4C18662AEE
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9FA314C8877B1FA1F912B4C18662AEE
                                                      • Size 484B
                                                      • SHA256 5f911b980d4981a36a03eb758ddbb558de5db327c16876e7488ed73e38ca4fc9
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                      • Size 416B
                                                      • SHA256 7b895e2ee7fb8ed9a1798b83324185be5ddddd23a185d7a3e54c7f6de3962fbb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      AIChat_74764841.exe
                                                      • Path C:\Users\Admin\AppData\Local\AIChat_74764841.exe
                                                      • Size 3.6MB
                                                      • SHA256 6430a772eb047467aa0c3e4bc964719dbf85b9adc58e63738a8652099ba6f8ec
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      OperaGX_74764841.exe
                                                      • Path C:\Users\Admin\AppData\Local\OperaGX_74764841.exe
                                                      • Size 4.0MB
                                                      • SHA256 5d8190b87288aa08617538708709f692e787b3bf15ef19db2ccdfbe33e3d6c98
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      136.0.6008.76.manifest
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\136.0.6008.76.manifest
                                                      • Size 225B
                                                      • SHA256 9dfc1f09de7f3d585c5b6bbb366e008d38507b8a9bcbc461bfe2a69d9c380629
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-100.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-100.png
                                                      • Size 2KB
                                                      • SHA256 9635c074c9d8edde0baf3111dbd7db49cbdc370c4f729c80ac382949f32be526
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-100_contrast-white.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-100_contrast-white.png
                                                      • Size 1KB
                                                      • SHA256 28ce8fcb22080ce1f69346cb0720bbe5662959e413426f00062b706013da8c28
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-140.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-140.png
                                                      • Size 3KB
                                                      • SHA256 a36a13a5d5e3d39e3018ccc5f8859944c87256f8be24a3c08a6bf3cb06a26804
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-140_contrast-white.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-140_contrast-white.png
                                                      • Size 2KB
                                                      • SHA256 0bd63fe653885286e180fbdf6d1dadc66af242b8ed6bd1d03d8c5eccc20e91d7
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-180.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-180.png
                                                      • Size 3KB
                                                      • SHA256 6a8f64754c75edcc9abc1138e44acbd7064d7e8e2a28783939241dbd6afa30a5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-180_contrast-white.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-180_contrast-white.png
                                                      • Size 3KB
                                                      • SHA256 a706b332e6a846357a86c30d0e8bb7697e7dd55c2ae592dd45611ddce0c0bf14
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-80.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-80.png
                                                      • Size 1KB
                                                      • SHA256 7e6b0d9ea7fda1b5ca7a0b01290521dff943da4cbf1498412ca7d749db42c32d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      150x150Logo.scale-80_contrast-white.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-80_contrast-white.png
                                                      • Size 1KB
                                                      • SHA256 dfd1054f989cdee25f19ea792f363f042a125cab537a424f0224bbee13607e39
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      70x70Logo.scale-100.png
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\70x70Logo.scale-100.png
                                                      • Size 1KB
                                                      • SHA256 a333d7e4293f5269426b3fcb673a284f3708a66f957de62403b6570b24bae8f5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      installer.exe
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                                                      • Size 9.2MB
                                                      • SHA256 cdd0be1bf1c6f5b28085cb391f4a7027725c8f37e20d4319f55835e7dd21c98f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_prefs.json
                                                      • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json
                                                      • Size 1KB
                                                      • SHA256 c112741d4683e36b83fb7702bdc8df97b15834fdbaab47c3d89be6c5ce43f4f5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Opera GX Browser.lnk
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\Opera GX Browser.lnk
                                                      • Size 1KB
                                                      • SHA256 b0be6cb63781194730fa756b09c9837c5ea05e0ca62c2bb73a706de53fec13a4
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      additional_file1.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\additional_file1.tmp
                                                      • Size 2.9MB
                                                      • SHA256 cdb600359a2ee392e9ff11e680770171531760b6d64319cf6bffc5c1341a0dc0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      assistant_installer.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\assistant_installer.exe
                                                      • Size 2.5MB
                                                      • SHA256 5dda5f3ca9e230e79dc6c74ab74afe8d027cbd4db293ab0260dcf71010f6ff9b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      dbgcore.DLL
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\dbgcore.DLL
                                                      • Size 196KB
                                                      • SHA256 0a08d02dbba60e940694a2c154d4b78969df546d40d8ec314cf6be1753f009d1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      dbghelp.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\assistant\dbghelp.dll
                                                      • Size 1.8MB
                                                      • SHA256 bb4c23816f445ae5122ba5fc7d8cdd77bb9e519ab107f450320829a98df52175
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_prefs_include.json
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\installer_prefs_include.json
                                                      • Size 342B
                                                      • SHA256 4feb5dfe5263d42b38cfa17e5d30c11286990e4c5008592f96957cf125b739b5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      installer_prefs_include.json
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\installer_prefs_include.json
                                                      • Size 357B
                                                      • SHA256 8c768c4a64ed5a2f54d9957e8f4f983d65cbbe79bd08a36c2a1d08940b5044b4
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      installer_prefs_include.json
                                                      • Path C:\Users\Admin\AppData\Local\Temp\.opera\791abf79-1859-445e-b8a2-3c34586a5fc4 Opera GX Installer Temp\opera_package_202609300656021\installer_prefs_include.json
                                                      • Size 1KB
                                                      • SHA256 086a7635f0e56cabe5b847c340407a4d48eebc94645d8b1386224942fcce9114
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      installer.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS443F16D8\installer.exe
                                                      • Size 9.2MB
                                                      • SHA256 2511fbf843679b4d8070f3ee4360abab2420ba0dc5f359faecb724e51c6dffe6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      GameBooster_CreateStartupTask.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_CreateStartupTask.ps1
                                                      • Size 1KB
                                                      • SHA256 e44dce271422bf943413d99eef29114e49d91571422d58e5710d8df5616669ef
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      GameBooster_log.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_log.txt
                                                      • Size 84B
                                                      • SHA256 ce1c3779f8db82f4eb0f03fd9c00c0b3ec5074c8d33fb6150bb8cd59ebf2dee3
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      GameBooster_log.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_log.txt
                                                      • Size 126B
                                                      • SHA256 0e5b794537ed9ba980f217480b61442807ed08b476d7a34be612cbe4b7568fef
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      __PSScriptPolicyTest_gkpko4z5.0el.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gkpko4z5.0el.ps1
                                                      • Size 60B
                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      System.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsh486B.tmp\System.dll
                                                      • Size 12KB
                                                      • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      license-ack.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsh486B.tmp\license-ack.txt
                                                      • Size 16B
                                                      • SHA256 6489d6d7a33c5d40e18fc61eeb6c34c341279ee61816394dde5189aa4ad8fae5
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      nsis_tauri_utils.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsh486B.tmp\nsis_tauri_utils.dll
                                                      • Size 33KB
                                                      • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      content.js.LICENSE.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\content.js.LICENSE.txt
                                                      • Size 1KB
                                                      • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Icon_Light_Active.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\icons\128\Icon_Light_Active.png
                                                      • Size 2KB
                                                      • SHA256 97d9553a4f725354a6d5c3eff11f31285fd89c3b150593f04785b83d0a56efc2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Icon_Light_Available_Red.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\icons\128\Icon_Light_Available_Red.png
                                                      • Size 2KB
                                                      • SHA256 9eccebdbdb61efc0cbd8bccf3a5fedc6f9a1ebe5084b160783f90a56cd1efa7b
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Icon_Light_Available_Yellow.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\icons\128\Icon_Light_Available_Yellow.png
                                                      • Size 2KB
                                                      • SHA256 c165ef60bf3806cd0a7121a8d6cfd06909fc84b38a07d43e809bd7bff564099c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Icon_Light_Neutral.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                                      • Size 2KB
                                                      • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Icon_Light_Active.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\icons\32\Icon_Light_Active.png
                                                      • Size 883B
                                                      • SHA256 50aa1dcfa9083b57dd6187752b2c149294210be12d263b793d27daf8d431954c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Icon_Light_Available_Red.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\icons\32\Icon_Light_Available_Red.png
                                                      • Size 895B
                                                      • SHA256 2278e95b28851ade57217ab5c7b32598c44e1085693a3e26379643d29fa0a6d1
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Icon_Light_Available_Yellow.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\icons\32\Icon_Light_Available_Yellow.png
                                                      • Size 895B
                                                      • SHA256 726a50a9c008449ab7bafbf21325bfc72093b7ae6a56c5be90cf8c32a8a44641
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      rules.json
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_2015023575\CRX_INSTALL\rules.json
                                                      • Size 839B
                                                      • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      favicon_opera_one.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_43396662\CRX_INSTALL\favicon_opera_one.png
                                                      • Size 2KB
                                                      • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      reader_mode.js
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_43396662\CRX_INSTALL\reader_mode.js
                                                      • Size 112KB
                                                      • SHA256 17f8a5c1d70acee668cc6964317d88802d4409c32b0d7e292b95e1de8ddb16df
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      spotify_frame_interceptor.js
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_43396662\CRX_INSTALL\spotify_frame_interceptor.js
                                                      • Size 5KB
                                                      • SHA256 895ef6ae0efde6f5e8af23d1acbfac4a5351bda31c89d2e64c05f2de0181dd56
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      icon-57.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_612048868\CRX_INSTALL\icons\icon-57.png
                                                      • Size 873B
                                                      • SHA256 8462b976325b85e3fe1140685159792a700d5382f2307d5eb667af10e76d8964
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      aichat.exe
                                                      • Path C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                                      • Size 13.1MB
                                                      • SHA256 b085082eb2af43465549651cb3cd42145861f8f9d7de68b2e37a5671a09c0a68
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 0793707eab9053e5a3ffcd143565a19852c9926959ca8f41fc05b91c78a15540
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 c9a839c4d33d573f9b2277b322b6f5a345555ab10f0391acbf78b08a836b2bdb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      throttle_store.dat
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\throttle_store.dat
                                                      • Size 20B
                                                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 48B
                                                      • SHA256 1855567b59921437bbe1bad8aa93c987b3da1e3353ef4eee201d564a8f761f14
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 144B
                                                      • SHA256 7c9840de8554a76b1994f00f3f31e232d912910eb81c3a090c0ef5c0b7c346ec
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      MANIFEST-000001
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                      • Size 41B
                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\Network Persistent State
                                                      • Size 111B
                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      SCT Auditing Pending Reports
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                      • Size 2B
                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Preferences
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Preferences
                                                      • Size 6KB
                                                      • SHA256 a760525ba856519c1b69443ff93cd727e834d2f1acfc87cc06ad61b7f5a7446b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Preferences~RFe59ffe2.TMP
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Preferences~RFe59ffe2.TMP
                                                      • Size 6KB
                                                      • SHA256 8c8614c62553bfa078bbdc4c168962018cd948227f9eecdde75f160201ea9a39
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      CURRENT
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Site Characteristics Database\CURRENT
                                                      • Size 16B
                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      data_0
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_0
                                                      • Size 8KB
                                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      data_1
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_1
                                                      • Size 264KB
                                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      data_2
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_2
                                                      • Size 8KB
                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      data_3
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_3
                                                      • Size 8KB
                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                      • Size 1KB
                                                      • SHA256 4dc2aa1cdbc2d786993de69273b8085d7e2da6689978dad0938fa55976e70476
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                      • Size 2KB
                                                      • SHA256 f6723b6b279e8fe276952e8d92880aef94cc50fa39d2a8e1020899f4af090951
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                      • Size 3KB
                                                      • SHA256 d8052f58f08b08a6fd55a021ba06c0ee73b7cf969631a89261d287f5f7e4fe33
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                      • Size 16KB
                                                      • SHA256 7f87e5184bcff10a049ee92d3b9272814c90b08441263ff5816dfb21ddc093b7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State~RFe5961cd.TMP
                                                      • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State~RFe5961cd.TMP
                                                      • Size 1KB
                                                      • SHA256 02ba9969184b714f4ac94600fc4ac059d28512720d0120b41a72f80d5d62e2ca
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      f29a1fdc9454ba5a.customDestinations-ms
                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f29a1fdc9454ba5a.customDestinations-ms
                                                      • Size 23KB
                                                      • SHA256 c221cf1a17086b673ee1457b33ded7f632929048afdb46b09143962892f009ca
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      f29a1fdc9454ba5a.customDestinations-ms
                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f29a1fdc9454ba5a.customDestinations-ms
                                                      • Size 23KB
                                                      • SHA256 dd97e99eeb9a5c7a0c85ed2e13ecf35cfb4e50da8951437a67e1a67db1526cda
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      1cd13a82-0f88-499d-a71d-9ebcf872de95.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\1cd13a82-0f88-499d-a71d-9ebcf872de95.tmp
                                                      • Size 151B
                                                      • SHA256 1d8ce1644d213ad108c1602fca0536e33b9361deebd9360df9e5535fe0460247
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                      • Size 40B
                                                      • SHA256 41bba65064fbb5e260d054125d42b75bac10c30fb347b9d2c94589fee73674be
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      358161ab-0542-45e9-84bb-dc4a2d514c21.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\358161ab-0542-45e9-84bb-dc4a2d514c21.tmp
                                                      • Size 173B
                                                      • SHA256 b81dda972c8d655c08d93d5a2189e337a96647149f363525b081dbfe13e6c531
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      3ea87a4c-45bb-4267-921b-662591b0a866.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\3ea87a4c-45bb-4267-921b-662591b0a866.tmp
                                                      • Size 80KB
                                                      • SHA256 0df46377533b4fae238ec2854245ddc6a59192d465364d1f7c1b554ff699027f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      43d99a59-7daf-47b9-99d2-650d10c785e2.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\43d99a59-7daf-47b9-99d2-650d10c785e2.tmp
                                                      • Size 12KB
                                                      • SHA256 91a1f2dcfaff4c727bc0203a51de28e3705d838aa171ad1bd6f42d1b659c18bf
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      563fd18c-9fc4-43d8-9f33-5035919caa0e.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\563fd18c-9fc4-43d8-9f33-5035919caa0e.tmp
                                                      • Size 24KB
                                                      • SHA256 5fd86ca47266eddd9df9b31966daf2d85a7ef900d577b01a38a9de23a455eefe
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Bookmarks
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks
                                                      • Size 24KB
                                                      • SHA256 23ac34173d25d11cc4943afc383861000acd3430ff73666fd3dca1bb2cecac07
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      BookmarksExtrasa801c878-7206-4850-9fd2-04e4098f814f.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\BookmarksExtrasa801c878-7206-4850-9fd2-04e4098f814f.tmp
                                                      • Size 582KB
                                                      • SHA256 369b8d16cf7b1e9c538468bb80631a138dd27f019465b2e2cb0639075822119d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 48B
                                                      • SHA256 3c6e677fe24b5eb69294911fee94cba37b831c565f15ef51e157786c01a20f7b
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 1KB
                                                      • SHA256 1232f41277ad4d9047e79f5c4ec956e6117810350780aa48eb50654cee972006
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      index
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\wasm\index
                                                      • Size 24B
                                                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      messages.json
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\_locales\en\messages.json
                                                      • Size 2KB
                                                      • SHA256 57e2b257a65fa5e980c619214ed9ae25580bbd581143e28abac49928b31977a6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      background.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\background.js
                                                      • Size 17KB
                                                      • SHA256 c7a162a7650887dffe12034ddbba5ddb91ca5bf4f5478f59ded324f7e088bacb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      twitch16.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch16.png
                                                      • Size 370B
                                                      • SHA256 6534efc770a8a32c881258029c2f2b9d9f1b75228f53bf9b4cd2b9a9689884e0
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      twitch48.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch48.png
                                                      • Size 921B
                                                      • SHA256 47e37c0726206401cc69cb6ab0fdda79b364356a5e2fdbd5ce479bfbb965f245
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      main.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.8_0\main.js
                                                      • Size 47KB
                                                      • SHA256 9cc5e1dd96d76735499257c52d632a0a9e17ed4da929035067dadcc586000335
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      background.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\iadifhcoomlippfncokcbkajgmhjaglm\1.2.335_0\background.js
                                                      • Size 365KB
                                                      • SHA256 5acb8f0a54c6774e0832d8ee9c7fac2dd593b1a74c89c5f4a9ba3f12d878ebcf
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      icon-57.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\iadifhcoomlippfncokcbkajgmhjaglm\1.2.335_0\icons\icon-57.png
                                                      • Size 863B
                                                      • SHA256 7a1ae78e7cb77b74cbaefa5b92ec32384761499375738898e71bd43f018f3a17
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      logo_128.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_128.png
                                                      • Size 7KB
                                                      • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      logo_16.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_16.png
                                                      • Size 653B
                                                      • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      logo_32.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_32.png
                                                      • Size 1KB
                                                      • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      logo_48.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_48.png
                                                      • Size 2KB
                                                      • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      logo_64.png
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_64.png
                                                      • Size 2KB
                                                      • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      service-worker-loader.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\service-worker-loader.js
                                                      • Size 49B
                                                      • SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      MANIFEST-000001
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\IndexedDB\https_gxcorner.games_0.indexeddb.leveldb\MANIFEST-000001
                                                      • Size 23B
                                                      • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      016f1c1a-5d95-462f-8448-8abf4ab44205.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\016f1c1a-5d95-462f-8448-8abf4ab44205.tmp
                                                      • Size 27KB
                                                      • SHA256 b79b047aa13202f575c92b513e67530ee9a5de4755d8d67c85c2f156c9a4eb39
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      030f17e1-eea1-4af5-9551-66f36feee16a.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\030f17e1-eea1-4af5-9551-66f36feee16a.tmp
                                                      • Size 27KB
                                                      • SHA256 2f1a860dec73e59307d1a8e1b1ace276076ef77008f468720569bfc8d7ba2512
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      0cb89607-b3ed-4b82-8a4b-9145c5a70549.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\0cb89607-b3ed-4b82-8a4b-9145c5a70549.tmp
                                                      • Size 27KB
                                                      • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      94942648-3a99-4d4c-ada0-f82c0b93aa4b.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\94942648-3a99-4d4c-ada0-f82c0b93aa4b.tmp
                                                      • Size 27KB
                                                      • SHA256 353f070543d1c43247d565c23d4c0346a8d65d902aa7bae04c6ae5e64bc5cde7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      c4fef5ab-c1ed-4d16-a9f0-24f79759e320.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\c4fef5ab-c1ed-4d16-a9f0-24f79759e320.tmp
                                                      • Size 27KB
                                                      • SHA256 cc914b6c8be70f233d533244b1fe41e32c495b9bb57901a96777f7d19fd75dfa
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      d3f92612-72b8-4b86-9d27-be1fb8a3af4f.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\d3f92612-72b8-4b86-9d27-be1fb8a3af4f.tmp
                                                      • Size 165KB
                                                      • SHA256 6fb99d60d985b95855ae7bdfebe34156f705f865699f31190d0fc15f61d2a8e4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Network Persistent State
                                                      • Size 3KB
                                                      • SHA256 edd75bc10c09a32b328e2f44fcb555b2f70b14eb29deec534fc34c63e85d07a9
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Network Persistent State
                                                      • Size 59B
                                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Opera Custom Icon.icoc0efc3d3-c443-4d52-92c1-17982f538e8a.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.icoc0efc3d3-c443-4d52-92c1-17982f538e8a.tmp
                                                      • Size 162KB
                                                      • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Preferences
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                      • Size 16KB
                                                      • SHA256 8039d1515e9140d1b776e92b06e66f718b89a21c36070c738244945bc6aa7a72
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Secure Preferences
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                                      • Size 119KB
                                                      • SHA256 ea474de35952ac7e5180a2278d4abb2856114c228f78f535507e65517c7a2624
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      70281b89-1bee-4892-97ab-68ef6cfa7dcb.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\70281b89-1bee-4892-97ab-68ef6cfa7dcb.tmp
                                                      • Size 72B
                                                      • SHA256 4ef229f51588ca8a4917fffc76eeada4a777201603705e2ce53cbddc5a2aa30b
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                      • Size 552B
                                                      • SHA256 85e63d941ee444cbffcaa9b4a78a087ecddfa7e839bd9654b711ff05506b2172
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      9325688b-d4e6-4220-87b4-eab0a2a0f6ee.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\9325688b-d4e6-4220-87b4-eab0a2a0f6ee.tmp
                                                      • Size 429B
                                                      • SHA256 343119a5ea81a7e8df212fd4ffd03d0b5a407e433216579292a739b339b8c0aa
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 3d93bb996a3a5faf992ca32ec7fe7cba5ed345d8f18608e849442659ded4b1a5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 653B
                                                      • SHA256 d642cb2e92621fbc2b5efd2cc37dbd56912ed84908d10e7151a99d1a9abc80ca
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 5fd53ee90dc446f9fc7f10c68df852cb4859436e1445cb181619207ac9be9bb9
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 af9bf0340dbb18adc345013aacf3a70d689cf84b25212fa50ea7751a390187ee
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 10KB
                                                      • SHA256 bae049709c6ee45b7408099a4d2d40b959dd2996c21ef29c44efa14d94a163f0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 10KB
                                                      • SHA256 e231fcf06d7792bf384cf196dc500c07550b7620459bfc158cd4b6668e402303
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 a89bde754e8dc92ee62560feceb9b5500fcaeaf7c464f505852d4d911a2aeebe
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 72b04cc29fa63862c1089e4f536f05e3713163e460a6a82e86077a688152201d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 957B
                                                      • SHA256 2046f0044a919eb08e1e069e32d70347f66c2b6bf81d886ca76882758583f318
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 066e95516a7d74ca5b42e8c3be8d35c41048d290d8ca059369d53aba2570938c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 4af90fce165000e296d8476bc3fc9d57dc9fc1bdd5f40267f5382c8f6a672053
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 7fd1acab79ac40cbe8c7b73afb48dcf4fd1f616a6a658a33a0cf3a5dee93d9c7
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 3a9b7604724c0581fb3663f98885b19247e1104fda3d46dada387fad3d4a63aa
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 817baf01fbf4ae1a1206c546e2a3e333cee1de221e042e9c77a033c405a464d6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 f0ac0d75b00383a88000746030006b1dd659d8417d93cbeebf0af239490ec253
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 02e484b01058084fa1d684859a40b8800d9183936707f93b153f950ac21254d9
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 8167f32f173fe7bc60e0a7aee0826a61cdf1905bce83c5a1f3e02a88a139c87e
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 1KB
                                                      • SHA256 8eaa325fdd4a532a5b6a024722d9c0525453b3a421f0ea08f60b9f381c5b1d40
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 6c79543f4c4f0f4d1b64490ae0383c54f584529247c5154ae3dd44d592b75a78
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 dc55f9c60f200627e18ac0565e80a65220689d0d704b41578ee322a7baa8bcfa
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 879e7492b982e905207ed8568beb95e46b2bb8935661af8c209994b0a96adc47
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 f471641c723ee124c8706d1cb07f1f11e0a5173fa359ada3d16395dd0eb9e65b
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 b81d0944904bdbadbe4f1397d9d655de42d66d57f3efec30c43c505a3c6388ec
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 afc4f645950c82e6bd239fb6b0676171af9d07983fc18c424e4710fba0c9f6ad
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 d2f908ee853f7777198d9910b303ef7260d481f194e0947d0ed5724e8863e7dd
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 da8c32fa8da65241e71dc74894dbafa679923b26899e3caf5dd172b72e2ca988
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 440eab9b8042807ab8102cea46331391e6c3725be4ff55c8ebac6d712b105182
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 6a909f1b9d55d0b82b5bba7f41320bf6967d707ad035a13ae68329c7f1f276a2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 60d53be91dc5c4be9671b804f5f2cddd53dfc7f977f7b083b8158ccea312b194
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 94fe78ac682b94e19a47628a81f10ff1228f324d2c06b84ace3bb649d84f3be6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 c95e0bb7fa25fc7b06459be95c06b75c05a9a955c4a3203cf093263dee60da4e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 68d7ae4eccfd6a56227d1c73e5442087c16780db8379d8a0ca97ea35609b521c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 c1f24920990c4eb2f487eafd8956b819801ba03100d6fb6c3242c7b84bc1124f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 1f38c19bd40d81f497b07d63f0999c56dab20a2003141f1770b81a1838f1c157
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 7f08c23cf359da4143546ca017ed905fecd470a85da2dbca110f2f2f17fe4683
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 37fb8ed0e7d2fdf08fb6fe474260e30c4ef5dddf6b36986eaa2b0db1f842d3f0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 36643d17fcae61eae3a2d500edfe85989896ea4e2f577c5533daf02ef38f55c6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 0893f34e6a61d48cfdab6e487e02587bf0e54f4f970c4f0306a09a98a6b2b2bc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 62db861f11d84d6da0e0ac4bdc01eba23ff34cd7e9348185a7488f256b6d6dc4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 294966fc983b3df5ff05c6597aa9f85fc9819bf75a90ba78850cdb66ef7fe8b5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 7d6f07a5123ee4ad47f209d2bcfe42803678646b7b89296ff4ff097646daddd9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 509ba15105324aaa24986b9ba655758329fb92b02ffb4124894a63cc8d343210
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 6e8e0e63dac54a08ec95a074dac34d140abe1d7ab821bfc55c485e38d7456798
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 dae2c2de0ddc9ba4bbf737e0c5434aa0a5a00ddfce9068fa191c6cb1afba8f74
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 8fa18d984354e03f8e5ce0ac356af090990bb12014980245393dc80460375ca4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 22eeb3934ab5090aacb030e60549c79707793c045a35fb8d09944b2ea922436c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 10KB
                                                      • SHA256 d3495412e7f8c6c749d89a860715f20d496c93922f1b5e4efc8f739957acba1e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 942b02ccdf94f8f42851fc396c597cf807ba11943c244c5f9914a2c434f64871
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 7c24e046583653bc82fb5c521446e9a1992a842a2c513100351fffb38696822e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 3c007fc6e19cdd12a23bc8dc19cf7cf761433c491b86f8af6645ec72c1cd670b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 c98c7190123244b2a922ffaf2110ce15a326f7cd7a09511202297511534c396b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 3146cccf44d774808a72c95155ae931fd171dfdadfb529b2b7839cafe691d1c1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 dbec95b76372060146ca96eca7dbf978311875bfbc3cd8624d112dd7c4599284
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 0b5af7b20563e3c0db7e4661d1e5d25702c20ddc0a8410c3c1f67d60ac0e489e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 541B
                                                      • SHA256 cfa60c52be3d4b5847226dbb26934ccf8d6837b08f440bba5edaa156124f84de
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 781B
                                                      • SHA256 429fdb436c6ce01fcba219f562ccbc882e300a22f435692ff7d7307ffea7a8aa
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 2KB
                                                      • SHA256 b7601810da84897bf791e46ea17bceb081751f66bdcca0521ba35bd1a1ba5bfe
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 7eda1c91fd22b4964991dba14cac40ec7c03119b3970c79f3e5bb0095f6df888
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 6dbc8cb9d70760913b36c72c228bbfa39b10a10336839162887849dc3cdd498c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 10KB
                                                      • SHA256 28ccb3f2f0156c6ef241fbe3f892e02ff93752df33650f25944d3169e6a9f263
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 f323c5b8f31dde87ad46acf5809414146ccf3b371db7f99d040ef5fdef670ff1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 032a4604928fec34c4716a2d560654affb03f4214312ec127b8beb36b7364c7a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 ed0848cc7958fd229b65f7a54bd83ff35301bdd39600480b492013bb2bf3bd2e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 772a68cde87c4caf00791a7d239fe8ae76edf051a3eb91f1ee2ac7177397691d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 72fcc7c92f9689db736c494b8a6a7b9f30454e831e4de07da120f636562d8817
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 8KB
                                                      • SHA256 5ac3ea095b36b7ded54064ba6510d61c38dfdcffd20cd2b9580f0ee158c01695
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 f14c8fe2ff09aa4a197f54149fff996b1a5295a9bd81bc217b4fe3f943c56e82
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 b75343b1f4b62465a61ad7198b2db1154941896cbc7a1e5d1e953f45c99178e0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 6b10e0860a5301aad7ba2533a848aa46b845f50aefc0910ede29f2488566dedc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 aab5b16dbcb65441b0532d9c413318c208e2be83d56307a977ebe9210bcd3b7e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 8bb4f61dfee0058998819a4cdbcfe80f1f74cab0df1ed3a46deb1ea533344f3f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 45c4c01fd37b5183a7f4ee254c01d20cb224f82fe641348458be6832c0789f16
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 11KB
                                                      • SHA256 9f0c5d0f4703fb958383c21c8e2e644d05642e37af4fb4e43c7a83b009ad0b30
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 fcda37c47b402558864011e1ef3f1169cb648b821bba041dd8cb12363d58807c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 9KB
                                                      • SHA256 2b349a329b182bc712561e0f7a58f130f2d60cb04f47df37db1c8087d338d71d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 a758bc939e39598e518d613371050dd1754eeb9b569f75508a273cdfcc9ac03b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 35ae3bd645b4a73e442fddfbf1b22274fb7fca09fa20b1c7818c285207cbdda5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 3ec611aea3436f922b503624ebf53d39419c271e676fa87f685f9790e1c81ed6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_f4b8e896-bc2b-4f6f-8b3a-87576efecf1f.raw
                                                      • Size 12KB
                                                      • SHA256 d0da35fa97a8c6a6a3a6fe568fc8a56316f0965717b3ee74db24f486e5acb263
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      a8678794-6c55-4b17-bdef-996db549aa8a.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\a8678794-6c55-4b17-bdef-996db549aa8a.tmp
                                                      • Size 171B
                                                      • SHA256 0ff86849be262548cb6cf72c62ee4909e1417733f18456f17e4ba46165926d3d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      e8ee9038-5399-42a6-b99a-1ced808c0eff.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\e8ee9038-5399-42a6-b99a-1ced808c0eff.tmp
                                                      • Size 414B
                                                      • SHA256 448450f68f4dc00f3e535460df7eeca575896a2999f6b9de632b39aa396997f1
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1KB
                                                      • SHA256 e647f9d7cc2eabbea1420e3c99028818018fd2066effe8529701ebd0924366a0
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 507B
                                                      • SHA256 7385dd7243d366546bec54e13335272565f99c603650dd8b573dd307e1e17148
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 599B
                                                      • SHA256 53cb6d2c6eaf653d961da7b5d4096733bd66de6ab9965c9e014df5ec4ef3d7a2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 691B
                                                      • SHA256 8bff87aaeb225e1f79dc9bd8cfc7341c9053172c1c4e1cead3979fd25d8047bf
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 780B
                                                      • SHA256 258de93c9d9793595cabaf197a08567a833e024bb7a830a88e0c2aff3c5e6a96
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 871B
                                                      • SHA256 18dfdf415d8c9f4da7113d881a46dfc95f9e47421d0bb7c64f68792f0910da67
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1000B
                                                      • SHA256 2dc17e680aa7544b02de5786f2c7297bf042914ffa812ad9b0e68f228628f984
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1KB
                                                      • SHA256 06d62361c026acab9d22d4d373cb1573b726c18269df8a47631ae0251c41343b
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1KB
                                                      • SHA256 6852a1f33ec562c73cfb4f5463f7c0457d4a37cf2a46b53ffbb557d60636763a
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1KB
                                                      • SHA256 ac9979827a58e4ee9494400c8ae9e53e50ce67222096405c78d4cfbd0c40d712
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1KB
                                                      • SHA256 20a82f765c0974c181b2fdd2e1e34838b7ba2cc7cf8748f504352919e865b785
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 3KB
                                                      • SHA256 08e4bc7e5eb0a7cb385dd3f4dc9cc9ee82ef5ac135f720e8c1a23100ef130cdc
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 2KB
                                                      • SHA256 49bc848867479bb8a09253c1e3beafb5a0ed1ec80feea114571585fb9723c9c4
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 2KB
                                                      • SHA256 1ebf0d9bd43fad9b16a515bde24da06064fa81540ea655a9890a3958582245a5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 3KB
                                                      • SHA256 d2ef243661ad388144fc3fc55e15009fde6f07c7d6448f3ebe85f37dd8c28bb0
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 3KB
                                                      • SHA256 8b9509756e331a1b1cf6f4bc6ab449165177dc90fd438e243287786e34bfdc59
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 3KB
                                                      • SHA256 1b5708e509c1eda1108556cfe65ff73d2ccf5cd09a318e398edb01d3776520d5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1KB
                                                      • SHA256 c36eef52d17e48f10c3507e612fee651a270fa75b2ba7245fc0cf20c09ed789b
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 3KB
                                                      • SHA256 ac50ce852aee799755370c4aac4886ae78d6fbe16d892609c2f5d31c91fe52e1
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 3KB
                                                      • SHA256 be41132611531ca854ef5b0ddf17a891b2b139ac15eb58bac6cfac951f85a655
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 3KB
                                                      • SHA256 1cdba1f3ba31d50edd3bb426e521d50f7cf13f9d2b986493329493b51b595e29
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.0.1185730409
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.0.1185730409
                                                      • Size 1KB
                                                      • SHA256 f84d910509c6a2733a812c28a6f91eac0dd9e302686fa44bf7d6e92f1490eda2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 2KB
                                                      • SHA256 c85a2a9898f760474611ca2a8d8a59b30a62349599ae688972313a0acc5e2db2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 1KB
                                                      • SHA256 318a42553e87238e08e330ca0174241d1f18d9d10a54b852ae4d837810c52875
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 224B
                                                      • SHA256 7bb7e5a22059cdb9fcc1b833ef6a85f0deb9ec7264fa454160f0887610180204
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 420B
                                                      • SHA256 3f5eb2f1384d4765c438a5cfbadae19dfd0ac42259b1f7333c1fd4c61d8e76df
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 1KB
                                                      • SHA256 5a46beb420e9af38cc0ffebeeb80925b32193f0c4a8cc28a8f141add53e15746
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 2KB
                                                      • SHA256 92b094a67c98ade6ad50241fef8cdf2ee8470b4247f79578e878a5e37a29bee8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 200B
                                                      • SHA256 b546649d9e51018c01b894101e8d094f2aa5aa2f7680a396c55347a006d61de1
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 482B
                                                      • SHA256 053396620af4b689006c918e19670adb35b041f031c2cbe20ba94332c483c5a6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 2KB
                                                      • SHA256 02ac3a24ad1fec49884a5ed662e042fe3b01eb36eebf8c12317418c14c781b3d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 2KB
                                                      • SHA256 1b6e3f5f62d6ecb9d63f8fa86ee58ed6b9b6dcf94d9da8b5fee58aed96023492
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 2KB
                                                      • SHA256 47c66de7e935d80794e5b2090a7925f7569ce3510808249bceb2633e1f8eae5f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 2KB
                                                      • SHA256 315d1b3ed3c13260bd59675b76cb63c7550f28b35c5802c64d00704579f07a67
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.1.1244609273
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.1.1244609273
                                                      • Size 2KB
                                                      • SHA256 350aef17e062e13498c01b6aeaff97372b7849d3bd47187bb54fb9b65b4b44a8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssdfp6104.2.452778094
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp6104.2.452778094
                                                      • Size 217B
                                                      • SHA256 253ed9a92040ec28056552cbb3a3d3576aa30e97a8e80a05e8fe104bc1b34b4a
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                      • Size 3KB
                                                      • SHA256 45bedcc228b4ab0783489e6ffbab7f81ba06e6cfe23c811f41ebc7f56bb985e8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      VariationsSeedV2
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                                      • Size 11B
                                                      • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      VariationsSeedV2
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                                      • Size 19B
                                                      • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      assistant_prefs.json
                                                      • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\assistant_prefs.json
                                                      • Size 151B
                                                      • SHA256 83cc744a7b13b6d7169b0178f15c6067913368b91f16956d9829b6352c47cb4a
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      hyph-bn.hyb
                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_626350760\hyph-bn.hyb
                                                      • Size 703B
                                                      • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      hyph-mr.hyb
                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_626350760\hyph-mr.hyb
                                                      • Size 687B
                                                      • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      hyph-nn.hyb
                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_626350760\hyph-nn.hyb
                                                      • Size 141KB
                                                      • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      memory/560-300-0x00007FFE306F0000-0x00007FFE306F1000-memory.dmp
                                                      Download

                                                      memory/2596-383-0x00007FFE31E80000-0x00007FFE31E81000-memory.dmp
                                                      Download

                                                      memory/2596-384-0x00007FFE31BC0000-0x00007FFE31BC1000-memory.dmp
                                                      Download

                                                      memory/3296-382-0x00007FFE306F0000-0x00007FFE306F1000-memory.dmp
                                                      Download

                                                      memory/4496-113-0x00000153BDB30000-0x00000153BDB52000-memory.dmp
                                                      Download

                                                      memory/6156-753-0x00007FFE31E80000-0x00007FFE31E81000-memory.dmp
                                                      Download

                                                      memory/6156-752-0x00007FFE31BC0000-0x00007FFE31BC1000-memory.dmp
                                                      Download