Overview

overview

8

Static

static

3

Velocity E...41.exe

windows10-ltsc_2021-x64

8

Velocity E...41.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    89s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 05:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Velocity Exploit_74764841.exe
  • Size 702KB
  • Sample260930-gmd8bsysds
  • SHA256 74b57e66864831c686f2a1bb445c7ba2a4bd5d985aa9879e67bb8a7c847e04f5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 5 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 7 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 56 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 13 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Loads dropped DLL
    PID:1648
    • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
      2⤵
        PID:6156
        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x294,0x298,0x29c,0x22c,0x2a0,0x7ff641376598,0x7ff6413765a8,0x7ff6413765b8
          3⤵
            PID:8156
          • C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe" --version
            3⤵
              PID:1976
        • C:\Users\Admin\AppData\Local\Temp\Velocity Exploit_74764841.exe
          "C:\Users\Admin\AppData\Local\Temp\Velocity Exploit_74764841.exe"
          1⤵
          • Downloads MZ/PE file
          • Drops file in Program Files directory
          • Reads the TCP/IP host and domain name from the registry
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Users\Admin\AppData\Local\OperaGX_74764841.exe
            C:\Users\Admin\AppData\Local\OperaGX_74764841.exe --silent --allusers=0
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4324
            • C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe
              C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe --silent --allusers=0 --server-tracking-blob=YTY5OTQ4YmU1MDZjZWU5MDliNmY3NTA5OWFmMTY4ZDYxMjIyZTc0ODNmYmQ5YjNlZWVjNWE3ZjMxZjlmMDdjZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTdlMGEyYjBmMjFlNTQ2YTViNTMxYzVkNzY3ZWJiYWZjIiwidGltZXN0YW1wIjoiMTc5MDc0Nzc1Ny43NjUzIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiN2UwYTJiMGYyMWU1NDZhNWI1MzFjNWQ3NjdlYmJhZmMiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI4NWY1OTRiMy0wOTM0LTQ4ZWYtOGYwOC00YTc4MmZjZjExYWEifQ==
              3⤵
              • Downloads MZ/PE file
              • Executes dropped EXE
              • Enumerates connected drives
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:3412
              • C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe
                C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff6f2b77998,0x7ff6f2b779a8,0x7ff6f2b779b8
                4⤵
                • Executes dropped EXE
                PID:2920
              • C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\installer.exe" --version
                4⤵
                • Executes dropped EXE
                PID:2840
              • C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3412 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_20260930065600" --session-guid=d7c1a93b-4ebe-4888-94de-393b18e0f885 --server-tracking-blob=ZmYyNDVkYTk4OTYwYzQ3M2VhYjFmODhiNzgzOTA3OWQzZjkxMGVmMzE3NjczMTZmM2Q5MjBmNzRlNDRkNWNkYzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTdlMGEyYjBmMjFlNTQ2YTViNTMxYzVkNzY3ZWJiYWZjIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkwNzQ3NzU3Ljc2NTMiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiI3ZTBhMmIwZjIxZTU0NmE1YjUzMWM1ZDc2N2ViYmFmYyIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6Ijg1ZjU5NGIzLTA5MzQtNDhlZi04ZjA4LTRhNzgyZmNmMTFhYSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3008000000000000
                4⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Suspicious use of WriteProcessMemory
                PID:5456
                • C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x7ff6f2b77998,0x7ff6f2b779a8,0x7ff6f2b779b8
                  5⤵
                  • Executes dropped EXE
                  PID:852
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --backend --initial-pid=3412 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001" --session-guid=d7c1a93b-4ebe-4888-94de-393b18e0f885 --server-tracking-blob=ZmYyNDVkYTk4OTYwYzQ3M2VhYjFmODhiNzgzOTA3OWQzZjkxMGVmMzE3NjczMTZmM2Q5MjBmNzRlNDRkNWNkYzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTdlMGEyYjBmMjFlNTQ2YTViNTMxYzVkNzY3ZWJiYWZjIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkwNzQ3NzU3Ljc2NTMiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiI3ZTBhMmIwZjIxZTU0NmE1YjUzMWM1ZDc2N2ViYmFmYyIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6Ijg1ZjU5NGIzLTA5MzQtNDhlZi04ZjA4LTRhNzgyZmNmMTFhYSJ9 --silent --desktopshortcut=1 --install-subfolder=136.0.6008.76
                  5⤵
                  • Executes dropped EXE
                  • Enumerates connected drives
                  • Enumerates system info in registry
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1256
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff7daaf7998,0x7ff7daaf79a8,0x7ff7daaf79b8
                    6⤵
                    • Executes dropped EXE
                    PID:2208
                  • C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Writes a Windows system DLL name to a user directory
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Suspicious use of WriteProcessMemory
                    PID:1912
                    • C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xfbc9cc,0xfbc9d8,0xfbc9e4
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:4928
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:2044
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xa1c9cc,0xa1c9d8,0xa1c9e4
                        8⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:3880
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                        8⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Reads the TCP/IP host and domain name from the registry
                        • System Location Discovery: System Language Discovery
                        • Enumerates system info in registry
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:5872
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          9⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:3968
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0xac,0x15c,0x160,0x104,0x164,0x7ff95342ec30,0x7ff95342ec40,0x7ff95342ec50
                            10⤵
                            • Executes dropped EXE
                            PID:5444
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                          9⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates system info in registry
                          • Suspicious use of WriteProcessMemory
                          PID:3840
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ff95342ec30,0x7ff95342ec40,0x7ff95342ec50
                            10⤵
                            • Executes dropped EXE
                            PID:3008
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x294,0x298,0x29c,0x25c,0x2a0,0xd57324,0xd57330,0xd5733c
                          9⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3752
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            10⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:5848
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ff95342ec30,0x7ff95342ec40,0x7ff95342ec50
                              11⤵
                              • Executes dropped EXE
                              PID:1764
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            10⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:4040
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ff95342ec30,0x7ff95342ec40,0x7ff95342ec50
                              11⤵
                              • Executes dropped EXE
                              PID:3628
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                            10⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates system info in registry
                            • Suspicious use of WriteProcessMemory
                            PID:5188
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x164,0x168,0x16c,0x160,0x170,0x7ff95342ec30,0x7ff95342ec40,0x7ff95342ec50
                              11⤵
                              • Executes dropped EXE
                              PID:1340
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Reads the TCP/IP host and domain name from the registry
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:1844
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x108,0x10c,0x110,0x144,0x164,0x7ff95342ec30,0x7ff95342ec40,0x7ff95342ec50
                      7⤵
                      • Executes dropped EXE
                      PID:5620
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1612,i,6289632888840373476,13086648796509445332,262144 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1900 /prefetch:2
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5640
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2016,i,7237829113706332677,17093966617551574344,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2012 /prefetch:11
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Reads the TCP/IP host and domain name from the registry
                      • System Time Discovery
                      PID:1148
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2508,i,4631335676225984151,1773108835406835592,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2600 /prefetch:13
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4288
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=2928,i,1434036615842955823,14820956558531853661,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3396 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:2672
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3304,i,1423859715463279504,8853887296527209252,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3416 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:5704
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3316,i,17850709829161677972,8623585619840676700,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3448 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:2420
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3276,i,6983937472814565549,3872878697002477358,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3468 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:3432
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3280,i,10152540592428693601,14995044212597576072,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3376 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3408
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3672,i,15811095828070451089,3818337480591087235,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3404 /prefetch:1
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:2992
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3292,i,9513024458152239498,13512102095464497378,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3356 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:2340
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                      7⤵
                      • Executes dropped EXE
                      PID:6468
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4768,i,5006042293020063158,15082427263043497164,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4784 /prefetch:1
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:6728
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4940,i,17090774007450397414,3319029553256256711,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4972 /prefetch:9
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6744
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5096,i,8419143256195533621,12796073248917646589,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5140 /prefetch:1
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6800
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5376,i,17463004466893496484,9837543304612879321,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5372 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      PID:6868
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5272,i,8880718891255387924,4446640962030172096,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5364 /prefetch:1
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6844
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5384,i,12181394036522706966,2737387713023642332,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5484 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6840
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5392,i,948464357995599717,13688320847602594052,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5232 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6812
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5396,i,13804092542856275294,152343397699299451,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5488 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6820
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4912,i,8216362551104398765,9853352261455449301,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=1596 /prefetch:9
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6888
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6908,i,10155140084168564621,18214288155604236051,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6952 /prefetch:9
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6060
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5668,i,13148585288201050200,17146348893566493907,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7172 /prefetch:1
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6244
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6784,i,6615903268026085957,3240829965174947469,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5788 /prefetch:12
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6880
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7328,i,8309672872565681562,13715927200979969403,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6388 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:2968
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7360,i,16249283866104986799,2366933926278601163,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7456 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:4720
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7352,i,9434951993506778523,11229654176327575067,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7436 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:6580
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5100,i,15709705019789754314,5627227589168147862,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7476 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:6952
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7372,i,2638734878155729503,10351804999372004548,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7492 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:3176
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5848,i,18005105388026858735,11604486019851212013,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7516 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:4696
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7380,i,10851617651723163228,14617242939773549390,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7536 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:7668
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7388,i,18411977637058454922,2183694133635466910,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=7556 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:7676
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7404,i,5760655906328600690,10378085353692137869,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=7576 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:2652
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7344,i,8700624933545121980,8792043989684018584,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7416 /prefetch:14
                      7⤵
                        PID:4828
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7196,i,9271024904714198838,10939036578100308461,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8084 /prefetch:14
                        7⤵
                          PID:6416
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8968,i,15468806029277892717,15788912394968369968,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8988 /prefetch:14
                          7⤵
                          • Enumerates system info in registry
                          PID:6776
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8452,i,6870849123389911338,9203931761534811900,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8960 /prefetch:9
                          7⤵
                          • Enumerates system info in registry
                          PID:7052
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                          7⤵
                            PID:5452
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff641376598,0x7ff6413765a8,0x7ff6413765b8
                              8⤵
                                PID:7072
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6672,i,5460072721808737297,4475049673477596035,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=5144 /prefetch:14
                              7⤵
                              • Enumerates system info in registry
                              PID:7316
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6496,i,341851302964227170,9692704611515530789,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9456 /prefetch:14
                              7⤵
                              • Enumerates system info in registry
                              PID:7340
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3428,i,11925854493677159312,1398473115599353622,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=3700 /prefetch:14
                              7⤵
                              • Enumerates system info in registry
                              PID:6216
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=10148,i,4761502036174757299,11296380640692868499,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10180 /prefetch:1
                              7⤵
                                PID:7292
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7544,i,3360992609418927554,8678826707949191620,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=7556 /prefetch:14
                                7⤵
                                  PID:7576
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3248,i,7966891032043716105,4674688159561837020,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=5828 /prefetch:14
                                  7⤵
                                    PID:2808
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5676,i,5832348563609798471,12613375559028256367,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=3716 /prefetch:14
                                    7⤵
                                      PID:6816
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9424,i,12912225503860257969,2187210855044402755,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=7824 /prefetch:14
                                      7⤵
                                        PID:5064
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8200,i,16141198874226891710,12014532992312049458,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=7416 /prefetch:14
                                        7⤵
                                          PID:800
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=4080,i,10936289380783944710,9788136935763908300,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=9444 /prefetch:14
                                          7⤵
                                            PID:6336
                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=10088,i,8148826720257895713,7949275952308719893,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=9288 /prefetch:14
                                            7⤵
                                              PID:6828
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=5520,i,17510612921167173711,3921612875190291083,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=3568 /prefetch:14
                                              7⤵
                                                PID:7676
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9604,i,7427490788934517171,2338758452966465176,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=4088 /prefetch:14
                                                7⤵
                                                  PID:7592
                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=4100,i,582935671909239087,6044073623163993994,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=3652 /prefetch:14
                                                  7⤵
                                                    PID:6364
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3372,i,5436798431055550781,11491576566403501724,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=3640 /prefetch:14
                                                    7⤵
                                                      PID:7956
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9348,i,7182774850664091481,2684959082814674076,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=9336 /prefetch:14
                                                      7⤵
                                                        PID:7324
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=3328,i,17201753503799971412,4183998681402878613,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=7724 /prefetch:14
                                                        7⤵
                                                          PID:7816
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=6524,i,3453070773126269013,6895409077593783037,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=10144 /prefetch:14
                                                          7⤵
                                                            PID:6232
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7868,i,2252609133131207893,8132617695433169940,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=7876 /prefetch:14
                                                            7⤵
                                                              PID:6268
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7864,i,6269673374538924414,4732235649254680593,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=8380 /prefetch:14
                                                              7⤵
                                                                PID:5536
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9372,i,17024794245606420555,4981848383187784502,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=9376 /prefetch:14
                                                                7⤵
                                                                  PID:4292
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=9532,i,14931919235969706612,13932261416593464674,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=9388 /prefetch:14
                                                                  7⤵
                                                                    PID:7624
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8732,i,1998536752440264994,8321409122902079568,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=8704 /prefetch:9
                                                                    7⤵
                                                                      PID:6772
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=8748,i,1086659936547879744,4243905941692594079,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=7592 /prefetch:14
                                                                      7⤵
                                                                        PID:5712
                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --metrics-shmem-handle=7640,i,387818809672147184,3496956069449389357,524288 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=8688 /prefetch:14
                                                                        7⤵
                                                                          PID:7468
                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7612,i,11678427459120728614,4825363298852119826,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=8048 /prefetch:9
                                                                          7⤵
                                                                            PID:6868
                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=7596,i,11010353010390331571,10393870692133870953,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=9092 /prefetch:9
                                                                            7⤵
                                                                              PID:7596
                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=10512,i,1671396594818566549,17569624058043680953,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=10556 /prefetch:9
                                                                              7⤵
                                                                                PID:8728
                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7804,i,6561385482195652334,9310796246909642797,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=10680 /prefetch:9
                                                                                7⤵
                                                                                  PID:9040
                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=10724,i,379521014047333494,352242613588199202,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=10768 /prefetch:9
                                                                                  7⤵
                                                                                    PID:8496
                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-ref:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=10760,i,15168343756924560668,6541747660792810326,2097152 --field-trial-handle=1904,i,18387560774003665757,12082598158234380301,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1912,i,13318880531610537786,6436460631307383551,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=8096 /prefetch:9
                                                                                    7⤵
                                                                                      PID:9412
                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe"
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • Writes a Windows system DLL name to a user directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4444
                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe" --version
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Enumerates system info in registry
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1300
                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xfbc9cc,0xfbc9d8,0xfbc9e4
                                                                                  5⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2720
                                                                          • C:\Program Files\Booster\GameBooster.exe
                                                                            "C:\Program Files\Booster\GameBooster.exe" install
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:700
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\GameBooster_CreateStartupTask.ps1"
                                                                              3⤵
                                                                              • Enumerates connected drives
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1876
                                                                          • C:\Users\Admin\AppData\Local\AIChat_74764841.exe
                                                                            C:\Users\Admin\AppData\Local\AIChat_74764841.exe /S
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:3788
                                                                            • C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                                                              "C:\Users\Admin\AppData\Local\aichat\aichat.exe" --hidden
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • Checks whether UAC is enabled
                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                              • Modifies system certificate store
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4984
                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4984.6088.8577747015970787382 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                                4⤵
                                                                                • Enumerates system info in registry
                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2860
                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView /prefetch:4 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff97b745fd8,0x7ff97b745fe4,0x7ff97b745ff0
                                                                                  5⤵
                                                                                    PID:3208
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1736,i,936797348350569465,10821561562606616539,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                                    5⤵
                                                                                      PID:1776
                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1736,i,936797348350569465,10821561562606616539,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                                      5⤵
                                                                                        PID:2664
                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1736,i,936797348350569465,10821561562606616539,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                                        5⤵
                                                                                          PID:1860
                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1736,i,936797348350569465,10821561562606616539,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6 /prefetch:1
                                                                                          5⤵
                                                                                            PID:1676
                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1220 --field-trial-handle=1736,i,936797348350569465,10821561562606616539,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                                            5⤵
                                                                                              PID:6392
                                                                                      • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Program Files directory
                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:476
                                                                                        • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                                          C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:dmddD53rQIC9439FDtPOPN -o:0
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies trusted root certificate store through registry
                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies system certificate store
                                                                                          PID:7012
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:5668
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:6496
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:4808
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:2736
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:6000
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:9920
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:9148
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:8384
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:8600
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:9056
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:9360
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:5536
                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                        2⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:4968
                                                                                    • C:\Program Files\Booster\GameBooster.exe
                                                                                      "C:\Program Files\Booster\GameBooster.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3316
                                                                                      • C:\Program Files\Booster\GameBooster.exe
                                                                                        "C:\Program Files\Booster\GameBooster.exe" --minimized
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:3064
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                      1⤵
                                                                                        PID:5380
                                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                        1⤵
                                                                                          PID:6628
                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Enumerates system info in registry
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:6768
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.76 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7ff95342ec30,0x7ff95342ec40,0x7ff95342ec50
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:6856
                                                                                        • C:\Program Files (x86)\PremierOpinion\pmservice.exe
                                                                                          "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Drops file in Program Files directory
                                                                                          • Modifies trusted root certificate store through registry
                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Modifies system certificate store
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:7076
                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                            C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1648
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            PID:7104
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
                                                                                            2⤵
                                                                                            • Drops file in Program Files directory
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1220
                                                                                          • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                            "c:\program files (x86)\premieropinion\pmropn.exe" -boot
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:7620
                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                              CheckNetIsolation.exe LoopbackExempt -s
                                                                                              3⤵
                                                                                                PID:9812
                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                CheckNetIsolation.exe LoopbackExempt -s
                                                                                                3⤵
                                                                                                  PID:8300
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 7620
                                                                                                2⤵
                                                                                                  PID:9668
                                                                                                  • C:\PROGRA~2\PREMIE~1\pmropn32.exe
                                                                                                    C:\PROGRA~2\PREMIE~1\pmropn32.exe 7620
                                                                                                    3⤵
                                                                                                      PID:9720
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 7620
                                                                                                    2⤵
                                                                                                      PID:9676
                                                                                                      • C:\PROGRA~2\PREMIE~1\pmropn64.exe
                                                                                                        C:\PROGRA~2\PREMIE~1\pmropn64.exe 7620
                                                                                                        3⤵
                                                                                                          PID:9728
                                                                                                      • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                                        "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
                                                                                                        2⤵
                                                                                                          PID:9868
                                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
                                                                                                            3⤵
                                                                                                              PID:9908
                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
                                                                                                              3⤵
                                                                                                                PID:9968
                                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
                                                                                                                3⤵
                                                                                                                  PID:10016
                                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.sechealthui_8wekyb3d8bbwe
                                                                                                                  3⤵
                                                                                                                    PID:10072
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.8_8wekyb3d8bbwe
                                                                                                                    3⤵
                                                                                                                      PID:10124
                                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
                                                                                                                      3⤵
                                                                                                                        PID:10176
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
                                                                                                                        3⤵
                                                                                                                          PID:3540
                                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
                                                                                                                          3⤵
                                                                                                                            PID:7104
                                                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
                                                                                                                            3⤵
                                                                                                                              PID:4568
                                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
                                                                                                                              3⤵
                                                                                                                                PID:8704
                                                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
                                                                                                                                3⤵
                                                                                                                                  PID:6812
                                                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy
                                                                                                                                  3⤵
                                                                                                                                    PID:9092
                                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
                                                                                                                                    3⤵
                                                                                                                                      PID:8260
                                                                                                                                • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:9640

                                                                                                                                  Network

                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                        Reconnaissance

                                                                                                                                        Resource Development

                                                                                                                                        Initial Access

                                                                                                                                        Execution

                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                        1
                                                                                                                                        T1059

                                                                                                                                        PowerShell

                                                                                                                                        1
                                                                                                                                        T1059.001

                                                                                                                                        Persistence

                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                        1
                                                                                                                                        T1547

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1547.001

                                                                                                                                        Event Triggered Execution

                                                                                                                                        1
                                                                                                                                        T1546

                                                                                                                                        Component Object Model Hijacking

                                                                                                                                        1
                                                                                                                                        T1546.015

                                                                                                                                        Hijack Execution Flow

                                                                                                                                        1
                                                                                                                                        T1574

                                                                                                                                        DLL Search Order Hijacking

                                                                                                                                        1
                                                                                                                                        T1574.001

                                                                                                                                        Privilege Escalation

                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                        1
                                                                                                                                        T1547

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1547.001

                                                                                                                                        Event Triggered Execution

                                                                                                                                        1
                                                                                                                                        T1546

                                                                                                                                        Component Object Model Hijacking

                                                                                                                                        1
                                                                                                                                        T1546.015

                                                                                                                                        Hijack Execution Flow

                                                                                                                                        1
                                                                                                                                        T1574

                                                                                                                                        DLL Search Order Hijacking

                                                                                                                                        1
                                                                                                                                        T1574.001

                                                                                                                                        Defense Evasion

                                                                                                                                        Hijack Execution Flow

                                                                                                                                        1
                                                                                                                                        T1574

                                                                                                                                        DLL Search Order Hijacking

                                                                                                                                        1
                                                                                                                                        T1574.001

                                                                                                                                        Masquerading

                                                                                                                                        1
                                                                                                                                        T1036

                                                                                                                                        Match Legitimate Name or Location

                                                                                                                                        1
                                                                                                                                        T1036.005

                                                                                                                                        Modify Registry

                                                                                                                                        3
                                                                                                                                        T1112

                                                                                                                                        Subvert Trust Controls

                                                                                                                                        2
                                                                                                                                        T1553

                                                                                                                                        Install Root Certificate

                                                                                                                                        2
                                                                                                                                        T1553.004

                                                                                                                                        Credential Access

                                                                                                                                        Credentials from Password Stores

                                                                                                                                        1
                                                                                                                                        T1555

                                                                                                                                        Credentials from Web Browsers

                                                                                                                                        1
                                                                                                                                        T1555.003

                                                                                                                                        Unsecured Credentials

                                                                                                                                        1
                                                                                                                                        T1552

                                                                                                                                        Credentials In Files

                                                                                                                                        1
                                                                                                                                        T1552.001

                                                                                                                                        Discovery

                                                                                                                                        Network Share Discovery

                                                                                                                                        1
                                                                                                                                        T1135

                                                                                                                                        Peripheral Device Discovery

                                                                                                                                        1
                                                                                                                                        T1120

                                                                                                                                        Query Registry

                                                                                                                                        5
                                                                                                                                        T1012

                                                                                                                                        System Information Discovery

                                                                                                                                        5
                                                                                                                                        T1082

                                                                                                                                        System Location Discovery

                                                                                                                                        1
                                                                                                                                        T1614

                                                                                                                                        System Language Discovery

                                                                                                                                        1
                                                                                                                                        T1614.001

                                                                                                                                        System Network Configuration Discovery

                                                                                                                                        1
                                                                                                                                        T1016

                                                                                                                                        System Time Discovery

                                                                                                                                        1
                                                                                                                                        T1124

                                                                                                                                        Lateral Movement

                                                                                                                                        Collection

                                                                                                                                        Data from Local System

                                                                                                                                        1
                                                                                                                                        T1005

                                                                                                                                        Command and Control

                                                                                                                                        Exfiltration

                                                                                                                                        Impact

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        cacert.pem
                                                                                                                                        • Path C:\Program Files (x86)\PremierOpinion\cacert.pem
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        GameBooster.exe
                                                                                                                                        • Path C:\Program Files\Booster\GameBooster.exe
                                                                                                                                        • Size 715KB
                                                                                                                                        • SHA256 3bf07d3bfa2cb446e0bcbe889647a0734ab0255edf6b7290ac4c3e9d2e667fef
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        hgsdk.dll
                                                                                                                                        • Path C:\Program Files\Booster\hgsdk.dll
                                                                                                                                        • Size 7.4MB
                                                                                                                                        • SHA256 2720d215168108700767f8e9b57819d55ca139d69d8d828186da186850a37c6c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                                                                                                        • Size 183KB
                                                                                                                                        • SHA256 8c31a00f076834640ed444d3396e338b33cb67f3fca11f7822ab365e44258f8f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                        • Size 281B
                                                                                                                                        • SHA256 38dea488c2b4b0b239bbc28290e2b50ebc954ddeb7b36a7ffacaed5cf28bffc6
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                        • Size 471B
                                                                                                                                        • SHA256 f4c81da45da3889780c4e61596bdbc7544a9306861551a6634dae51963e36fd2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
                                                                                                                                        • Size 248B
                                                                                                                                        • SHA256 f3272a8d92ff561cd84a81667efc42de3c4ab4598ec49d0f0904073e37fa8039
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                        • Size 484B
                                                                                                                                        • SHA256 c5448433ae53d1d0497b9333da2bac0687f733575331d71c91e65f52ed47644d
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                        • Size 416B
                                                                                                                                        • SHA256 fceb9f0aeb389ea74de46d2a305c10adcbd137550f4d0895c9a735cbbd433288
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        AIChat_74764841.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\AIChat_74764841.exe
                                                                                                                                        • Size 3.6MB
                                                                                                                                        • SHA256 6430a772eb047467aa0c3e4bc964719dbf85b9adc58e63738a8652099ba6f8ec
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        OperaGX_74764841.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\OperaGX_74764841.exe
                                                                                                                                        • Size 4.0MB
                                                                                                                                        • SHA256 f594652202fc482e8a8e00975f402e8cb0bbdc71a3ad15061256a2742875c2ff
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        136.0.6008.76.manifest
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\136.0.6008.76.manifest
                                                                                                                                        • Size 225B
                                                                                                                                        • SHA256 9dfc1f09de7f3d585c5b6bbb366e008d38507b8a9bcbc461bfe2a69d9c380629
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-100.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-100.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 9635c074c9d8edde0baf3111dbd7db49cbdc370c4f729c80ac382949f32be526
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-100_contrast-white.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-100_contrast-white.png
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 28ce8fcb22080ce1f69346cb0720bbe5662959e413426f00062b706013da8c28
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-140.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-140.png
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 a36a13a5d5e3d39e3018ccc5f8859944c87256f8be24a3c08a6bf3cb06a26804
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-140_contrast-white.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-140_contrast-white.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 0bd63fe653885286e180fbdf6d1dadc66af242b8ed6bd1d03d8c5eccc20e91d7
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-180.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-180.png
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 6a8f64754c75edcc9abc1138e44acbd7064d7e8e2a28783939241dbd6afa30a5
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-180_contrast-white.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-180_contrast-white.png
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 a706b332e6a846357a86c30d0e8bb7697e7dd55c2ae592dd45611ddce0c0bf14
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-80.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-80.png
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 7e6b0d9ea7fda1b5ca7a0b01290521dff943da4cbf1498412ca7d749db42c32d
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        150x150Logo.scale-80_contrast-white.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\Assets\150x150Logo.scale-80_contrast-white.png
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 dfd1054f989cdee25f19ea792f363f042a125cab537a424f0224bbee13607e39
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        installer.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.76\installer.exe
                                                                                                                                        • Size 9.2MB
                                                                                                                                        • SHA256 cdd0be1bf1c6f5b28085cb391f4a7027725c8f37e20d4319f55835e7dd21c98f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        installer_prefs.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 bd938bd0f26b438ea1d79aee8ff8645afe5052fd6f1c57800f1db906e3b213d2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Opera GX Browser.lnk
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\Opera GX Browser.lnk
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 423ded830ba9f30fec87babc9225e1c71b20fe7f5b7bec57a1f91fe57faa5221
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        additional_file1.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\additional_file1.tmp
                                                                                                                                        • Size 2.9MB
                                                                                                                                        • SHA256 cdb600359a2ee392e9ff11e680770171531760b6d64319cf6bffc5c1341a0dc0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        assistant_installer.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\assistant_installer.exe
                                                                                                                                        • Size 2.5MB
                                                                                                                                        • SHA256 5dda5f3ca9e230e79dc6c74ab74afe8d027cbd4db293ab0260dcf71010f6ff9b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        dbgcore.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\dbgcore.dll
                                                                                                                                        • Size 196KB
                                                                                                                                        • SHA256 0a08d02dbba60e940694a2c154d4b78969df546d40d8ec314cf6be1753f009d1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        dbghelp.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\assistant\dbghelp.dll
                                                                                                                                        • Size 1.8MB
                                                                                                                                        • SHA256 bb4c23816f445ae5122ba5fc7d8cdd77bb9e519ab107f450320829a98df52175
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        installer_prefs_include.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\installer_prefs_include.json
                                                                                                                                        • Size 342B
                                                                                                                                        • SHA256 c4e2ca0ed27cf3c34f059ebb2245c81e0b8ef2a61effa4e88ed9870c38b02eb9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        installer_prefs_include.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\installer_prefs_include.json
                                                                                                                                        • Size 357B
                                                                                                                                        • SHA256 412c5176841951aa141c2c5cfe11059ba617975f26c772dbb43454cd76d5eb8f
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        installer_prefs_include.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\af448924-2d3a-4c42-92f7-56c7eba5fad2 Opera GX Installer Temp\opera_package_202609300656001\installer_prefs_include.json
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 fe9f9052d31189e79deda732a1cc0372f17e6fcdeb46f0b24e047d9adece38fc
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        installer.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS4E0AAC3A\installer.exe
                                                                                                                                        • Size 9.2MB
                                                                                                                                        • SHA256 2511fbf843679b4d8070f3ee4360abab2420ba0dc5f359faecb724e51c6dffe6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        GameBooster_CreateStartupTask.ps1
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_CreateStartupTask.ps1
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 e44dce271422bf943413d99eef29114e49d91571422d58e5710d8df5616669ef
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        GameBooster_log.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_log.txt
                                                                                                                                        • Size 64B
                                                                                                                                        • SHA256 d06b12d097a67064b0b300019f21f44151300888f932c9d435001b2df589a2fa
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        GameBooster_log.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_log.txt
                                                                                                                                        • Size 126B
                                                                                                                                        • SHA256 0e5b794537ed9ba980f217480b61442807ed08b476d7a34be612cbe4b7568fef
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ContentI3.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                                                                                        • Size 3.8MB
                                                                                                                                        • SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        aichat-startup.log
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aichat-startup.log
                                                                                                                                        • Size 410B
                                                                                                                                        • SHA256 84ca1bde46cf2bbca422e5b7fb64a2208a1266587a4c15b47cd396770a11ddb9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        System.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nscEAF0.tmp\System.dll
                                                                                                                                        • Size 12KB
                                                                                                                                        • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        license-ack.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nscEAF0.tmp\license-ack.txt
                                                                                                                                        • Size 16B
                                                                                                                                        • SHA256 6489d6d7a33c5d40e18fc61eeb6c34c341279ee61816394dde5189aa4ad8fae5
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        nsis_tauri_utils.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nscEAF0.tmp\nsis_tauri_utils.dll
                                                                                                                                        • Size 33KB
                                                                                                                                        • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        favicon_opera_one.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1844_1360824782\CRX_INSTALL\favicon_opera_one.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        icon-57.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1844_637761521\CRX_INSTALL\icons\icon-57.png
                                                                                                                                        • Size 873B
                                                                                                                                        • SHA256 8462b976325b85e3fe1140685159792a700d5382f2307d5eb667af10e76d8964
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Icon_Light_Neutral.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1844_646328754\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        pmls.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os537C.tmp\pmls.dll
                                                                                                                                        • Size 884KB
                                                                                                                                        • SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        pmls64.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os537C.tmp\pmls64.dll
                                                                                                                                        • Size 1.1MB
                                                                                                                                        • SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        pmph.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os537C.tmp\pmph.dll
                                                                                                                                        • Size 806KB
                                                                                                                                        • SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        pmropn.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os537C.tmp\pmropn.exe
                                                                                                                                        • Size 7.4MB
                                                                                                                                        • SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        pmropn32.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os537C.tmp\pmropn32.exe
                                                                                                                                        • Size 244KB
                                                                                                                                        • SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        pmropn64.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os537C.tmp\pmropn64.exe
                                                                                                                                        • Size 303KB
                                                                                                                                        • SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        pmservice.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\~os537C.tmp\pmservice.exe
                                                                                                                                        • Size 4.6MB
                                                                                                                                        • SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        aichat.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                                                                                                                        • Size 13.1MB
                                                                                                                                        • SHA256 b085082eb2af43465549651cb3cd42145861f8f9d7de68b2e37a5671a09c0a68
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                                                                                                        • Size 280B
                                                                                                                                        • SHA256 dc70331bce72f1fdd5b69c2eed4015204ff4b1d34f3d940818b4fd005f04a106
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                                                                                                        • Size 280B
                                                                                                                                        • SHA256 b9649ec7c97dd845309f0e0ce46bb920f31334c252a828629b9ff475c57f4861
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        throttle_store.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                        • Size 20B
                                                                                                                                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        • Size 144B
                                                                                                                                        • SHA256 0b2a9695de28c2d3424d9b824da9cc32c20f9d85c1d6220904c81f99d77eab9a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index~RFe5b56c7.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b56c7.TMP
                                                                                                                                        • Size 48B
                                                                                                                                        • SHA256 82ad1e6ae6f84005641d61a53c8e6c9a31afbb248aa92443cdac9109a3a5822c
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        CURRENT
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Extension Scripts\CURRENT
                                                                                                                                        • Size 16B
                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        MANIFEST-000001
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Extension Scripts\MANIFEST-000001
                                                                                                                                        • Size 41B
                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\Network Persistent State
                                                                                                                                        • Size 59B
                                                                                                                                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\Network Persistent State
                                                                                                                                        • Size 111B
                                                                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                        • Size 2B
                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        a43ef32f-673b-496a-b097-b13e9f6ec99d.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\a43ef32f-673b-496a-b097-b13e9f6ec99d.tmp
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 949c01fe2a0db58654e464c169aac0d560dbfd11fc660fa8094a73112ae83ec3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        data_0
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GraphiteDawnCache\data_0
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        data_1
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GraphiteDawnCache\data_1
                                                                                                                                        • Size 264KB
                                                                                                                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        data_2
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GraphiteDawnCache\data_2
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        data_3
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GraphiteDawnCache\data_3
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 80e6b372c1561be383f80d2ef51a3e3c10b016f70045305829010ac42d78c7d1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 13c402280f6320683073cdd2c84d0d215791049a3b294d0254adfecd89fa6277
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 2f084599ca2a74ffa9daf786db672534d0c2fbc97b511acd95193409d8de13c3
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State~RFe5b0099.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State~RFe5b0099.TMP
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 0d69ad6577c40b97ac97df4fc311c6653927f38a92470d925b0cc53d84ed9807
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        file.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\file.txt
                                                                                                                                        • Size 58B
                                                                                                                                        • SHA256 631121117bfa16380944328fec84c08bc1d2e2a947b4133f9e3bca55ca9144a1
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        228785af771f6e25.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\228785af771f6e25.customDestinations-ms
                                                                                                                                        • Size 23KB
                                                                                                                                        • SHA256 ab6e356acf346559ab920f9f40811190327bdc0984001d8d8338f07f8bafaf78
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        228785af771f6e25.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\228785af771f6e25.customDestinations-ms
                                                                                                                                        • Size 23KB
                                                                                                                                        • SHA256 4bff341420b21f1a14998d45b8407afd736183c080a83d47cd098faa118b9b19
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        228785af771f6e25.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\228785af771f6e25.customDestinations-ms
                                                                                                                                        • Size 23KB
                                                                                                                                        • SHA256 ae0e8a6a152758bb9676763ffb8959ef6a27c106f5f77fedb25eb33f09a8beeb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                                                                        • Size 40B
                                                                                                                                        • SHA256 6c2ed89619cc4b32b499538371351f2bb2de2edcffd8d4e205b9cb588a0fc907
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        27cf1b85-205b-4326-84a7-30d760f489cb.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\27cf1b85-205b-4326-84a7-30d760f489cb.tmp
                                                                                                                                        • Size 79KB
                                                                                                                                        • SHA256 fde3f7458d580e2eb6a97fe491b7945fb73bf27f855982a4580f520ea8186474
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        60fc9e77-99f8-41d5-84c2-43136571de9e.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\60fc9e77-99f8-41d5-84c2-43136571de9e.tmp
                                                                                                                                        • Size 12KB
                                                                                                                                        • SHA256 153ca8323d0a9b56b4e583d3a4a70a2a6d1f638bdb6c730bcbe4d4099f1c6c74
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        9415869a-1d6e-4e7b-849e-a280fe3f685d.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\9415869a-1d6e-4e7b-849e-a280fe3f685d.tmp
                                                                                                                                        • Size 327B
                                                                                                                                        • SHA256 caf0ec3ec36695742e5ba53d784fac32485338dd925ecc21c77f52c933f8697b
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Bookmarks
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks
                                                                                                                                        • Size 24KB
                                                                                                                                        • SHA256 5dd7e5272df5272bfdc3fa377dd96ef0f61c7c09366ef59f7667b263a9738a11
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        BookmarksExtras
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\BookmarksExtras
                                                                                                                                        • Size 582KB
                                                                                                                                        • SHA256 369b8d16cf7b1e9c538468bb80631a138dd27f019465b2e2cb0639075822119d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        BookmarksExtras
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\BookmarksExtras
                                                                                                                                        • Size 2B
                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        • Size 48B
                                                                                                                                        • SHA256 6a4ab005720dd7af6077d5eddd0e67fc8e73af6ed095eb20f80aff91b936212e
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        • Size 960B
                                                                                                                                        • SHA256 82fdd95ccae0f21e8e449105b63e133a35a16d4d6f3df64b61aa2f85a45d7702
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        index
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\wasm\index
                                                                                                                                        • Size 24B
                                                                                                                                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        messages.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\_locales\en\messages.json
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 57e2b257a65fa5e980c619214ed9ae25580bbd581143e28abac49928b31977a6
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        background.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\background.js
                                                                                                                                        • Size 17KB
                                                                                                                                        • SHA256 c7a162a7650887dffe12034ddbba5ddb91ca5bf4f5478f59ded324f7e088bacb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        twitch16.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch16.png
                                                                                                                                        • Size 370B
                                                                                                                                        • SHA256 6534efc770a8a32c881258029c2f2b9d9f1b75228f53bf9b4cd2b9a9689884e0
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        twitch48.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch48.png
                                                                                                                                        • Size 921B
                                                                                                                                        • SHA256 47e37c0726206401cc69cb6ab0fdda79b364356a5e2fdbd5ce479bfbb965f245
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        main.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.8_0\main.js
                                                                                                                                        • Size 47KB
                                                                                                                                        • SHA256 9cc5e1dd96d76735499257c52d632a0a9e17ed4da929035067dadcc586000335
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        background.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\iadifhcoomlippfncokcbkajgmhjaglm\1.2.335_0\background.js
                                                                                                                                        • Size 365KB
                                                                                                                                        • SHA256 5acb8f0a54c6774e0832d8ee9c7fac2dd593b1a74c89c5f4a9ba3f12d878ebcf
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        icon-57.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\iadifhcoomlippfncokcbkajgmhjaglm\1.2.335_0\icons\icon-57.png
                                                                                                                                        • Size 863B
                                                                                                                                        • SHA256 7a1ae78e7cb77b74cbaefa5b92ec32384761499375738898e71bd43f018f3a17
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        logo_128.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_128.png
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        logo_16.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_16.png
                                                                                                                                        • Size 653B
                                                                                                                                        • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        logo_32.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_32.png
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        logo_48.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_48.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        logo_64.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_64.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        service-worker-loader.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\service-worker-loader.js
                                                                                                                                        • Size 49B
                                                                                                                                        • SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        favicon_opera_one.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68_0\favicon_opera_one.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        reader_mode.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68_0\reader_mode.js
                                                                                                                                        • Size 112KB
                                                                                                                                        • SHA256 17f8a5c1d70acee668cc6964317d88802d4409c32b0d7e292b95e1de8ddb16df
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        service_worker.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68_0\service_worker.js
                                                                                                                                        • Size 92KB
                                                                                                                                        • SHA256 e4a71cc9098780c7cd5ba8a5ebfdf9d3d281a5710ed3b596b6c751d2886cd8eb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        spotify_frame_interceptor.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68_0\spotify_frame_interceptor.js
                                                                                                                                        • Size 5KB
                                                                                                                                        • SHA256 895ef6ae0efde6f5e8af23d1acbfac4a5351bda31c89d2e64c05f2de0181dd56
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        background.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\background.js
                                                                                                                                        • Size 87KB
                                                                                                                                        • SHA256 b199d4f989c63947c53a9d07450038cfe274b7a10e8cc7d688c4049ae14ef63e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Icon_Light_Neutral.png
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\128\Icon_Light_Neutral.png
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        popup.js.LICENSE.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\popup.js.LICENSE.txt
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        rules.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\rules.json
                                                                                                                                        • Size 839B
                                                                                                                                        • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        MANIFEST-000001
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\IndexedDB\chrome-extension_jifbgnmbgbdiedhdecealmlgmekpagde_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                        • Size 23B
                                                                                                                                        • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        3cd01a65-b2b9-4847-b609-683a052094c3.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\3cd01a65-b2b9-4847-b609-683a052094c3.tmp
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 cc914b6c8be70f233d533244b1fe41e32c495b9bb57901a96777f7d19fd75dfa
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        579068d6-bff9-47e7-9a6f-5f8c74bd166b.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\579068d6-bff9-47e7-9a6f-5f8c74bd166b.tmp
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 06fad05c51b9041e1eee874086a13075af058630a44e160890f8ad6cc52cd6d6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        58a6bad1-30b9-4c3f-90ad-860231d85e28.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\58a6bad1-30b9-4c3f-90ad-860231d85e28.tmp
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        5fbc0b39-f0e5-4dc6-adf8-355581b2fdbb.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\5fbc0b39-f0e5-4dc6-adf8-355581b2fdbb.tmp
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 2f1a860dec73e59307d1a8e1b1ace276076ef77008f468720569bfc8d7ba2512
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        72dee8bf-db2b-416f-9c27-d63691ba6a37.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\72dee8bf-db2b-416f-9c27-d63691ba6a37.tmp
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 3e9c6d63eac83dee7079d552aa831a36fcf48ab6b1d6503ebef88797d82e0baf
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        a8d91b19-893f-4071-8904-2ad708a206ec.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\a8d91b19-893f-4071-8904-2ad708a206ec.tmp
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 353f070543d1c43247d565c23d4c0346a8d65d902aa7bae04c6ae5e64bc5cde7
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        dc2b7ec4-a346-4b19-910e-5befc674bd0e.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\dc2b7ec4-a346-4b19-910e-5befc674bd0e.tmp
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 b79b047aa13202f575c92b513e67530ee9a5de4755d8d67c85c2f156c9a4eb39
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Opera Custom Icon.ico47c606aa-ae9c-4a24-83dc-3d8ba9c1cfa5.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.ico47c606aa-ae9c-4a24-83dc-3d8ba9c1cfa5.tmp
                                                                                                                                        • Size 162KB
                                                                                                                                        • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                                        • Size 13KB
                                                                                                                                        • SHA256 b4c97ae188c1d65fa7026dcd044f6c12e3c782282c5c7c86e31567b4ded691ea
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                                        • Size 13KB
                                                                                                                                        • SHA256 dc41eae84b2ae69d231af13500829b2147e72130ef06f5fc72aeca943dd8cf37
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                                        • Size 12KB
                                                                                                                                        • SHA256 fb4fea7e06e9d6d22a8e398796f5804db9898dbcf5e189d990965869ffdd9dca
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Secure Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                                                                                                                        • Size 119KB
                                                                                                                                        • SHA256 b6cd27370d739fbf702712b11cea13f0fc765449dc11ba25ada58f5c92f00454
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Secure Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                                                                                                                        • Size 118KB
                                                                                                                                        • SHA256 7551aaa20af7ed86dc958d42775598f09ef20199beeed6722d2b23688e113917
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        584f8baa-9c2b-4f15-8756-c5ae757ede48.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\584f8baa-9c2b-4f15-8756-c5ae757ede48.tmp
                                                                                                                                        • Size 72B
                                                                                                                                        • SHA256 389dc58664764ce6b76d91104532f8f5f664a1fff90255645876f8a0c4df2fae
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                        • Size 552B
                                                                                                                                        • SHA256 6247482a0397704ba3db2ea0f02660a985785df40de7127fe3db9d9a4adbbe00
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        82967bc9-2dc2-47c1-9f0a-13bc9083efec.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\82967bc9-2dc2-47c1-9f0a-13bc9083efec.tmp
                                                                                                                                        • Size 429B
                                                                                                                                        • SHA256 a299d58191ecd4b48d7854352a995dd2df96090b873e19ff2809d0cb9338b50d
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 a71fced84b1a44d7602cef1afa756bf37d1c2a78207bafb87c4de9a21e887d8e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 f399c5f589caacaf83b75108cec7c1266d13bd9370f41b05faada054540b7b01
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 e7910f2abf3fa46dffa5af5db928a66565e22f93f478dd1440356349dc0bd42e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 0119a94a14e907d0410272e972c7b5f4de0f96c2e85653df9f2a888135e7757e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 3323603021a272ced91fdd57102bfcacf0370a7c7b7b9dc6b9800b2f920e35c6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 89c845adbf985f01ec895e4b133ff5bfecf690bd6d58aae7e8f7a4cd1470c510
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 b8d947dcbe4eb0bfa6596077afeff1b9fe869669452dcf70c8514d522f270845
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 bf09ce8952c397691eb3aeb530b91f774a915c8f0dd5496d1e6818f5d211f05b
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 530d84ab9c3383f743cbae275246e8a62a739dd8d6e1780ceed49545b1e02535
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 982b9d90cc83d625a2bd5d5726dfac5bdbdd9510793869cd799230532141a45b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 fc66580cb0ca9c9ca5baac6d3fef79131389c5adc37f8f52ceadbcd4e59701aa
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 a54802ba9f116933fdf41067d924eeaf42b5825c84ab2bd26ec8a7f1c6d8fa5f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 3aeed8b6a9d5ae4d52aa852edd31fcdfdfb2f3bed4fda44b88d00a6b2122f6cf
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 541B
                                                                                                                                        • SHA256 72ffb973ffb6daf72ae5b6450e856bf58344bedcba752170a89e5226b212fad2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 653B
                                                                                                                                        • SHA256 a3522831e18ffb96c73a1905e255805d22566d4b0359aba84a2e1f0f475d00e2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 781B
                                                                                                                                        • SHA256 5821caefcd1556bab23347b73250d63be6369c9e1dfe99094b4137dd2530d044
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 973B
                                                                                                                                        • SHA256 06b355b413a01a9bbb62f7ec378d75a629d3eeb9a36a9874b46b6c390078e811
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 cbb6c21025143ae202399991c2326c59583b870c76c239c82cf6344b012f6f68
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 b80f092ef0ebeb764bb2a7637f6d0fc898609b041d218aa347e75e6027937760
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 b0825092a45d57e832ec88cb371c282b3276e8195c4ad4b743a8b2e316955569
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 e810443a776d2012ea9183ca446dbfb045106787a845deb2eae976395a0ca1d4
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 028f0cc98bcee57840c092b91ec4752ea77e04d62ee7ddf17258224223fc01d2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 9440467500ee07d44fcf7f820c1783552d9e70c7ebe34e2083aafce75d1f57a0
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 26815e5fe39088a5e7558f4487224ad638f22fa7eea183a05a9ab85db863a6cd
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 1c2e1e3d1731e11100a47953c28feec1942820d66c779196b558ce21456475f9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 db4b20db9dbaf1ba446d0bfd915bf1e6178fd7d51e65624eecbfeb0309ecdc5c
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 d7a044913e57b4be1b2a283152807ac3fcf71bfd634678ecf55ccf08097b64e5
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 77d1f4121a9e788e903c8842acf4cc0ac992cdd815985adfd9e1eb2e73390718
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 af7f61929193c83dc307a4dae0c9c2683d9a85b57260f2113ba2625e5de54b1d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 b74d3c0d9c61ae18ea084024f7237a93b17b2c04086babaa05be3dabb3920167
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 c4a6a810b00a5cd24ce7173042487319ab1fc845cd3887ded910eda6e4173191
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 a8a75155a57855c205228c9b48571d2edcbc1958b1e2cde88bc99e7a0df33d9b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 5c76c1b2b346ec8e33994153e68fd70494eec82ac405d9a2a3a3a848c8821d3f
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 de30b03cc17d3303cb16505e60e3812398bc91ea03bd22e3780d74f30216ff09
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 43204a443fc9bfbe546c33f748a3952f2b6f030cb39a4430e5c1fe4385e38a61
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 96922425c605f09f55899bbaa4ac868df6586f89e5b45c637636aa1d8778d622
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 47936307f792612279356b3b14f9807ff8fc8e992e318a926ec81f5dde59368c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 65f90f77f6b8189a2f01875fae2b363506fd735eeb2b36621027777b26b6a490
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 10a65df4bfce245f0f75269dee7710a933ae464b2695c285e550ffd612817662
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 5e5fa8462168f75efe6be29866751f98a68826b5a06f6d207aae5aa390072bf4
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 369a120868f02a82b4b7663d07457333e70613ca6069d8d102b53e3d16992836
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 55abfed376c469cacff9095cfbe63d2a6ca69477800aed003d5444beaf24addd
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 912bb72f7c337cc715af46522638097ca3e82143d4eb1f8f37650993ec7316fc
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.raw
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 54715cd271f1fddfa11e955baa453198a9ad19d4f5c2aad1a7dac265effe8e87
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.rawec0fcc91-7ec9-43e5-b31f-e1c677070e6e.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.rawec0fcc91-7ec9-43e5-b31f-e1c677070e6e.tmp
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 93c51a3a1e01ed0224be9f68304e1c4d1f663441046e4a48193893c34773620f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        session_635a5b0a-c76d-426a-967a-358f6cf934a7.rawef2a0c02-be80-413e-ac20-bb3dc9f888e3.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_635a5b0a-c76d-426a-967a-358f6cf934a7.rawef2a0c02-be80-413e-ac20-bb3dc9f888e3.tmp
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 8e86927e308d0bd824a772c035aeca5d9e303e4db980cc0c4e9bda702f4f027d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        cc4a80eb-b488-411b-b4f8-bde6e5ce56f3.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\cc4a80eb-b488-411b-b4f8-bde6e5ce56f3.tmp
                                                                                                                                        • Size 23KB
                                                                                                                                        • SHA256 553e6745d639042e413a6f1db1410d04a80568b8c0bb165fb294a91559f5c6c2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        da20a911-72fb-4ede-a93b-0788c8a6d928.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\da20a911-72fb-4ede-a93b-0788c8a6d928.tmp
                                                                                                                                        • Size 171B
                                                                                                                                        • SHA256 b41e8bd853153bff7a2ea21249c06742acc1140e15e9a9d1102ba1d6e55e2eb9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 25d1949e2887346bed8816ea05d0bfc58944868998cf730c2921d6d47095c90a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 81fd538eea565995ba523b3a085cd8749d0bf7e59d96a5cc214b9177f2c5bff8
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 547B
                                                                                                                                        • SHA256 3e8e263ff9c3b5070c5281227ca688a9c811ec25c03659c52ace37fccd6577c4
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 a9fc79bbb0eb7a2abe1d8d96f9ea25b1e6b575b73a035455c44a0f246a38b7b8
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 2ddc82ce50eacd7b23312f0a6979911189e8f0dcdda4729ef84c6603eb6a8f16
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 7a3e3c62a19792f20427fc73fe5b22ae2248ff7e5f140331c1527d3a7303646f
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 8235ab4070e5c5d5b824f455206e7f104548024a38a4dac5e778cebccbb36ba9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 3841c6fcd71fd3c3a57dd166a11719e3fbaa881633f83574048664c669f108dc
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 413b949987d634afd27fc211cc8ff29cfd48e87c2e7530fa3ff711f2608b105b
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 387B
                                                                                                                                        • SHA256 57d6510a49a74095258cbb4b4678d8c7b0baef19aa98eb694056d6bd25dd738e
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 485B
                                                                                                                                        • SHA256 4c1f1cc71e2f3517592e7630ae15aeca2c432db4089d1d464c209f53f947b02a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.0.1199901533
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.0.1199901533
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 7a73954fdb0402e9728f8e8f1fe2653a7ecbee42ab82823b55fc30ff8cd9fa10
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.1.1530042723
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.1.1530042723
                                                                                                                                        • Size 224B
                                                                                                                                        • SHA256 802ec2c6e56f715747003946c8ce7d0574c8c66527d66f8946fc144be161aa50
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.1.1530042723
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.1.1530042723
                                                                                                                                        • Size 224B
                                                                                                                                        • SHA256 4584864a3ca39b5f2473e2593a60bee03591e0601c24adebc8473d02f2bcf651
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.1.1530042723
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.1.1530042723
                                                                                                                                        • Size 224B
                                                                                                                                        • SHA256 f04b601d0883748af0759c6f553824603f837fa49490914d9573f068f4405f79
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.1.1530042723
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.1.1530042723
                                                                                                                                        • Size 224B
                                                                                                                                        • SHA256 58a6268200c6cd3e7215749f2875e69d2d0b076a70cf6f84b8c97d3b8c30c6d6
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.1.1530042723
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.1.1530042723
                                                                                                                                        • Size 200B
                                                                                                                                        • SHA256 750ad55d832c65a84f85f6f4e27337028bd4a82932ddf5c09f999d352cae3d7c
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ssdfp1844.1.1530042723
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp1844.1.1530042723
                                                                                                                                        • Size 224B
                                                                                                                                        • SHA256 8d6b6d25362e3e4b2d8cc206b8ec1a2a4ed71f856582a54419ea810647ace4c4
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 1bbcbcec90958fe21d27e0f961d3fde3745dbbb554b2b5122d1542d5b4115e72
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        VariationsSeedV2
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                                                                                                                        • Size 11B
                                                                                                                                        • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        VariationsSeedV2
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2
                                                                                                                                        • Size 19B
                                                                                                                                        • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        memory/800-1810-0x0000026BE2960000-0x0000026BE2961000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1676-374-0x00007FF99A940000-0x00007FF99A941000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1776-361-0x00007FF99A940000-0x00007FF99A941000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1876-121-0x00000165A5C40000-0x00000165A5C5E000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1876-108-0x00000165A5C10000-0x00000165A5C1A000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1876-97-0x00000165A5BF0000-0x00000165A5C0E000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1876-98-0x00000165A5EC0000-0x00000165A5F72000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1876-214-0x000001658CFE0000-0x000001658D984000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1876-90-0x00000165A5B50000-0x00000165A5B72000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2340-1544-0x0000024A1DF50000-0x0000024A1E113000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2340-787-0x0000024A1E120000-0x0000024A1E121000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2420-782-0x0000021A5AC20000-0x0000021A5AC21000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2420-1543-0x0000021A5AA50000-0x0000021A5AC13000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2652-1582-0x0000025ED2BA0000-0x0000025ED2D63000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2652-1322-0x0000025ED2D70000-0x0000025ED2D71000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2672-779-0x000002121CDF0000-0x000002121CDF1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2672-1542-0x000002121CC20000-0x000002121CDE3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2808-1612-0x00000206C0610000-0x00000206C07D3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2808-1559-0x00000206C07E0000-0x00000206C07E1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2968-1329-0x00000216FB2B0000-0x00000216FB2B1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2968-1580-0x00000216FB0E0000-0x00000216FB2A3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3176-1315-0x00000138AF9E0000-0x00000138AF9E1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3176-1605-0x00000138AF810000-0x00000138AF9D3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3408-1132-0x00000216FC8E0000-0x00000216FCAA3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3408-789-0x00000216FCAB0000-0x00000216FCAB1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3432-1546-0x000001960EA10000-0x000001960EBD3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3432-785-0x000001960EBE0000-0x000001960EBE1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4288-1459-0x0000021A6B110000-0x0000021A6B2D3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4288-773-0x0000021A6B2E0000-0x0000021A6B2E1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4288-772-0x00007FF99B430000-0x00007FF99B431000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4696-1327-0x00000246839B0000-0x00000246839B1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4696-1579-0x00000246837E0000-0x00000246839A3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4720-1608-0x000001DC44DC0000-0x000001DC44F83000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4720-1339-0x000001DC44F90000-0x000001DC44F91000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4828-1583-0x00000201161B0000-0x0000020116373000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4828-1323-0x0000020116380000-0x0000020116381000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5064-1805-0x00000207D63A0000-0x00000207D63A1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5704-777-0x00000208C8550000-0x00000208C8551000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5704-1541-0x00000208C8380000-0x00000208C8543000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6216-1611-0x0000017898720000-0x00000178988E3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6216-1405-0x00000178988F0000-0x00000178988F1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6336-1828-0x000001EEE73A0000-0x000001EEE73A1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6416-1606-0x000001BA03BF0000-0x000001BA03DB3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6416-1319-0x000001BA03DC0000-0x000001BA03DC1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6580-1607-0x0000022C86D60000-0x0000022C86F23000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6580-1334-0x0000022C86F30000-0x0000022C86F31000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6776-1332-0x000002284F410000-0x000002284F411000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6776-1578-0x000002284F240000-0x000002284F403000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6816-1563-0x000002039DA90000-0x000002039DA91000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6816-1613-0x000002039D8C0000-0x000002039DA83000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6828-1840-0x000001B86A190000-0x000001B86A191000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6952-1325-0x00000195E7B60000-0x00000195E7B61000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6952-1581-0x00000195E7990000-0x00000195E7B53000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-861-0x00007FF99A0C0000-0x00007FF99A7B6000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-858-0x00007FF998970000-0x00007FF9989D8000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-854-0x00007FF99A870000-0x00007FF99A937000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-855-0x00007FF999CD0000-0x00007FF99A071000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-856-0x00007FF99AA60000-0x00007FF99AAD4000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-859-0x00007FF992640000-0x00007FF992766000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-857-0x00007FF986730000-0x00007FF9869B3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7104-860-0x00007FF998710000-0x00007FF998758000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7316-1377-0x000001A123140000-0x000001A123141000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7316-1609-0x000001A122F70000-0x000001A123133000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7340-1395-0x0000019529470000-0x0000019529471000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7340-1610-0x00000195292A0000-0x0000019529463000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7668-1318-0x0000027A6DCB0000-0x0000027A6DCB1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7668-1604-0x0000027A6DAE0000-0x0000027A6DCA3000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7676-1313-0x00000242E9B50000-0x00000242E9B51000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7676-1515-0x00000242E9980000-0x00000242E9B43000-memory.dmp
                                                                                                                                        Download