Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://work.ink/2zn...

windows10-2004-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    1199s
  • max time network
    1188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 14:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://work.ink/2znc/real-key-1?sr=WmVEOEpySWkwaDdPTkxYNUswbHVWRmozcE8zeUcwTlgyRytiNTkzVldjbHM5YTRGZlVwRjhBL3JOTlJnM2J5dS8ycUdoeGd1R1Z6VjVYaXg2a2RxN2s0MGt3VjBIZldNTU5iQjcvMDhMYnIzSWhBVS9iVjR0d2FQbEpsMHRickJOSXRDcm5FZmp1OXFkZ2hkbEErY2twZk8zLy9kcG1PTndjeVJQQ0ZsNlRKckZXY3diZjZzSXlYQWJtS0FOZTJGNFBVcjNXUT0%3D
  • Sample260930-rlccfsvclf
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 8 IoCs
  • Checks computer location settings 2 TTPs 41 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in Program Files directory 12 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 52 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://work.ink/2znc/real-key-1?sr=WmVEOEpySWkwaDdPTkxYNUswbHVWRmozcE8zeUcwTlgyRytiNTkzVldjbHM5YTRGZlVwRjhBL3JOTlJnM2J5dS8ycUdoeGd1R1Z6VjVYaXg2a2RxN2s0MGt3VjBIZldNTU5iQjcvMDhMYnIzSWhBVS9iVjR0d2FQbEpsMHRickJOSXRDcm5FZmp1OXFkZ2hkbEErY2twZk8zLy9kcG1PTndjeVJQQ0ZsNlRKckZXY3diZjZzSXlYQWJtS0FOZTJGNFBVcjNXUT0%3D
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd1540c188,0x7ffd1540c194,0x7ffd1540c1a0
      2⤵
        PID:1368
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,7084870971854850059,13134817471464396621,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:5068
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6368331397435517467,17005526947760860979,262144 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
        2⤵
          PID:3028
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,14714776569100328427,5462538050588917402,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
          2⤵
            PID:624
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12135594297377629779,12967358527272702829,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
            2⤵
              PID:2032
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10430788117787537492,13228590788687040078,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
              2⤵
                PID:1532
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7866261539277154349,7541631339046835777,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
                2⤵
                  PID:3988
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16147607966661783948,11052961454187764932,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
                  2⤵
                    PID:3832
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,3546256253496335692,12912754164722410010,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
                    2⤵
                      PID:2880
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5304,i,2209375564679850674,11699604116586234339,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
                      2⤵
                        PID:3484
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5428,i,3558170855762832121,6613667247642948070,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
                        2⤵
                          PID:3400
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,12795389892230665010,1962105374052545990,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
                          2⤵
                            PID:684
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,1098469359180153777,11281122698103404814,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
                            2⤵
                              PID:4076
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13252455244690240688,11512844723348420681,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
                              2⤵
                                PID:1888
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13252455244690240688,11512844723348420681,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
                                2⤵
                                  PID:2320
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6828,i,3412335171271863974,946777578409219530,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
                                  2⤵
                                    PID:1468
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6756,i,17330207844794151276,9858287514275869470,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
                                    2⤵
                                      PID:4948
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7004,i,5146291251402708145,1141298121683951738,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
                                      2⤵
                                        PID:980
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5020,i,12806487385814279185,3008724749241580630,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
                                        2⤵
                                          PID:4960
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7296,i,6441956897176126163,9761129948029765818,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
                                          2⤵
                                            PID:5396
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7464,i,15487255357536336987,1046954083773704846,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
                                            2⤵
                                              PID:5416
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7580,i,4376562365763303957,7324948593691936928,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
                                              2⤵
                                                PID:5472
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7808,i,2360267488803913557,15990147771944258064,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                                                2⤵
                                                  PID:5880
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7940,i,16534301567605202480,1935617398144323448,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:1
                                                  2⤵
                                                    PID:6120
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5080,i,13512291709670460540,18121546386792038437,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
                                                    2⤵
                                                      PID:5412
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,7505828055372381135,12485897217901456622,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:8
                                                      2⤵
                                                        PID:5832
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7636,i,2654243721132537646,13642255138111042727,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:8
                                                        2⤵
                                                          PID:5848
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,2522815880606741865,3556019861838644155,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:8
                                                          2⤵
                                                            PID:5852
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7700,i,421517907522798037,14887435996671048711,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:1
                                                            2⤵
                                                              PID:3468
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,13495708485156888389,13305126580915357404,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:8
                                                              2⤵
                                                                PID:3972
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8020,i,14754575167382485261,9111625594912851976,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
                                                                2⤵
                                                                • Modifies registry class
                                                                PID:2536
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,14494527305762460049,15345660401284441187,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
                                                                2⤵
                                                                  PID:5804
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,8423775105473807858,7603454646281615941,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
                                                                  2⤵
                                                                    PID:1884
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5168,i,15942269585712990888,14858912910415355113,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
                                                                    2⤵
                                                                      PID:2324
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,18374240410659168580,9626373116025346944,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
                                                                      2⤵
                                                                        PID:2580
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8364,i,12180959016288164866,8788645829457736534,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:8
                                                                        2⤵
                                                                          PID:4472
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4248,i,7618341247883764366,18141532024997157722,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
                                                                          2⤵
                                                                            PID:1620
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8108,i,10494694169299947457,17275760538128241624,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                                                            2⤵
                                                                              PID:2532
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8508,i,6606547079572235828,5988992366377884450,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
                                                                              2⤵
                                                                                PID:5672
                                                                              • C:\Users\Admin\Downloads\OperaInstaller (1).exe
                                                                                "C:\Users\Admin\Downloads\OperaInstaller (1).exe"
                                                                                2⤵
                                                                                • Downloads MZ/PE file
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5676
                                                                                • C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3000
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=YzZiNTI2NTEzODkwZmYzY2ExYzI5ZjFmNDY5YjM0ODNlNGYyODc0OWI0NDhjMjk1NWRkOGNkYjczYzljMDczZDp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhJnV0bV9jb250ZW50PTYxMjYzNCIsInRpbWVzdGFtcCI6IjE3OTA3Nzc4OTYuMzgyMSIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJzcG90aWZ5X29wZXJhIiwiY29udGVudCI6IjYxMjYzNCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJkMDFkOWRlZC1iZDA0LTRkMTgtODdmNC0xMjg3MDY3ZDJjYTUifQ==
                                                                                    4⤵
                                                                                    • Downloads MZ/PE file
                                                                                    • Executes dropped EXE
                                                                                    • Enumerates connected drives
                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                    • Enumerates system info in registry
                                                                                    • Modifies system certificate store
                                                                                    PID:5820
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff6e9e96998,0x7ff6e9e969a8,0x7ff6e9e969b8
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:3548
                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\installer.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\installer.exe" --version
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4840
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5820 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_20260930151821" --session-guid=eddc4656-a603-44cb-bcb9-9d03fe7b1b36 --server-tracking-blob=MDBlM2VlODk2MWM2YjhhMDhmYWZkMDA3ZmFhNjkxMjNlOTc2MDI4MDA3MzdmYTNjOTA2ZjAxODkzYzA0ZjY4Zjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhJnV0bV9jb250ZW50PTYxMjYzNCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MDc3Nzg5Ni4zODIxIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJjb250ZW50IjoiNjEyNjM0IiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJ3cmsifSwidXVpZCI6ImQwMWQ5ZGVkLWJkMDQtNGQxOC04N2Y0LTEyODcwNjdkMmNhNSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8808000000000000
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      • Enumerates connected drives
                                                                                      • Enumerates system info in registry
                                                                                      PID:640
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x294,0x298,0x29c,0x264,0x2a0,0x7ff6e9e96998,0x7ff6e9e969a8,0x7ff6e9e969b8
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4040
                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe
                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe" --backend --initial-pid=5820 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211" --session-guid=eddc4656-a603-44cb-bcb9-9d03fe7b1b36 --server-tracking-blob=MDBlM2VlODk2MWM2YjhhMDhmYWZkMDA3ZmFhNjkxMjNlOTc2MDI4MDA3MzdmYTNjOTA2ZjAxODkzYzA0ZjY4Zjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhJnV0bV9jb250ZW50PTYxMjYzNCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc5MDc3Nzg5Ni4zODIxIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJjb250ZW50IjoiNjEyNjM0IiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJ3cmsifSwidXVpZCI6ImQwMWQ5ZGVkLWJkMDQtNGQxOC04N2Y0LTEyODcwNjdkMmNhNSJ9 --silent --desktopshortcut=1 --install-subfolder=136.0.6008.80
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        • Enumerates connected drives
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:4680
                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe
                                                                                          C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff653e06998,0x7ff653e069a8,0x7ff653e069b8
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3304
                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Writes a Windows system DLL name to a user directory
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies Internet Explorer settings
                                                                                          PID:3252
                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x98c9cc,0x98c9d8,0x98c9e4
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4208
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Enumerates system info in registry
                                                                                            PID:3728
                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                                                                                              C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x48c9cc,0x48c9d8,0x48c9e4
                                                                                              9⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4728
                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                                                                                              9⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:2624
                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                                                                10⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:5672
                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                                  C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x23c,0x240,0x244,0x228,0x248,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                                  11⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2552
                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                                                                10⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Enumerates system info in registry
                                                                                                PID:4572
                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                                  C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x244,0x248,0x24c,0x240,0x238,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                                  11⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2144
                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                                                                C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x27c,0x280,0x284,0x250,0x288,0x1287324,0x1287330,0x128733c
                                                                                                10⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4440
                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                                                                  11⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:1836
                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                                    C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x23c,0x240,0x244,0x238,0x248,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                                    12⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4692
                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                                                                  11⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:5268
                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                                    C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x23c,0x240,0x244,0x238,0x248,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                                    12⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1200
                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                                                                  11⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Enumerates system info in registry
                                                                                                  PID:6020
                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                                    C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                                    12⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5404
                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\de932af914ba00303d4a2778a383ac9c831101e2.crx"
                                                                                          7⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Adds Run key to start application
                                                                                          • Drops file in Program Files directory
                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                          • Checks processor information in registry
                                                                                          • Enumerates system info in registry
                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3656
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                            C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4856
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1756,i,14506504145087643188,9180845467711321659,262144 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2008 /prefetch:2
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Enumerates system info in registry
                                                                                            PID:6264
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2180,i,10529386711342827945,2941163636160482842,524288 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2200 /prefetch:3
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                            • System Time Discovery
                                                                                            PID:6284
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2456,i,9539500975291608240,12162416680740752349,524288 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2552 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6384
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3588,i,2382154007421666400,8379428031440578857,2097152 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3608 /prefetch:2
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6648
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4296,i,5393346583217461526,4323174376857658895,524288 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3396 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6880
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4476,i,3398401915222430829,1507464374208662846,2097152 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4556 /prefetch:2
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6260
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4496,i,11150770977318351871,14499773852835258355,524288 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4540 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6796
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1764,i,1034158448072047122,5167934385283939302,524288 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4856 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6888
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5016,i,4971642600080064080,12718006212708499403,524288 --field-trial-handle=2012,i,2420472711036134072,9941669351236170779,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2016,i,15767300489213669188,17446257617458797203,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4888 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Enumerates system info in registry
                                                                                            PID:6924
                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\additional_file2.tmp"
                                                                                          7⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Adds Run key to start application
                                                                                          • Drops file in Program Files directory
                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                          • Checks processor information in registry
                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:7172
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                            C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:7208
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1736,i,11025135218045832890,2219890311666958371,262144 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2212 /prefetch:2
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Enumerates system info in registry
                                                                                            PID:7552
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1448,i,2390249227040450315,8513599488723841511,524288 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2244 /prefetch:3
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                            • System Time Discovery
                                                                                            PID:7636
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2564,i,9772680178517093818,2965502386730303887,524288 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2740 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:7384
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3940,i,3239600218665413002,13522832234698431584,524288 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3996 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:7708
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3928,i,8690755591700762741,5991055237140153694,2097152 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4016 /prefetch:2
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:7696
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4328,i,1331188712660069395,16411965312485570532,2097152 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4368 /prefetch:2
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            PID:7748
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3692,i,4209233310843801391,13318996932198882219,524288 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3760 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:7988
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4360,i,7082038235512058525,14501739242446370957,524288 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3688 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:6396
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4864,i,13404973979203706958,4650290044114859015,524288 --field-trial-handle=2216,i,2075527624588909562,4513950210044593365,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2220,i,6117116059566462576,17604114181313726713,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5028 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:6388
                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized
                                                                                          7⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • Drops file in Program Files directory
                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                          • Checks processor information in registry
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:6256
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                            C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3524
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1740,i,16376948609301793598,6783090620690175736,262144 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2060 /prefetch:2
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:7652
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1960,i,10677780498299010927,2873457968452131327,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:3
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                            • System Time Discovery
                                                                                            • Enumerates system info in registry
                                                                                            PID:7644
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2512,i,12402570985847409438,11257335911342189405,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2712 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:7580
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3360,i,12015675021529116011,3327270043467332076,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3448 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:7604
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3372,i,9004429304872016341,11041322767234362733,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3468 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:7764
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3408,i,2555384982311820523,17011087267203420525,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3528 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:7532
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3420,i,1603478058124135353,10353934707803551573,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3548 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:7628
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3384,i,7229120126640770997,8668713197572431648,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3488 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:7768
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3396,i,4429705932655587844,7380373093399891939,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3508 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:7724
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3432,i,11232836268340049708,11626548750462771456,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3568 /prefetch:8
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:7836
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4228,i,14419069420851759659,9549430394618987611,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4256 /prefetch:1
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            • Enumerates system info in registry
                                                                                            PID:6652
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_gx_splash.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C96
                                                                                            8⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4864
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4772,i,8872085776262980969,11526038674608752467,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4800 /prefetch:2
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            PID:1828
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4948,i,9287718179629208641,12120850928513735058,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4964 /prefetch:1
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            • Enumerates system info in registry
                                                                                            PID:7456
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5260,i,8622107160611577254,18429023443139276520,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5276 /prefetch:1
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            PID:6312
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5404,i,5646797992685949560,10569947125628014540,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5424 /prefetch:1
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            PID:6708
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6312,i,17866303448592045767,9861846666493696071,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6324 /prefetch:2
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            • Enumerates system info in registry
                                                                                            PID:7344
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6436,i,8272274230646179566,2713006694369294671,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5152 /prefetch:2
                                                                                            8⤵
                                                                                            • Checks computer location settings
                                                                                            PID:7952
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6776,i,10667129303098986571,7046180118838660456,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6780 /prefetch:8
                                                                                            8⤵
                                                                                              PID:7884
                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6740,i,12068704465682312357,16098615631154149869,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7036 /prefetch:1
                                                                                              8⤵
                                                                                              • Checks computer location settings
                                                                                              PID:1468
                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7172,i,17231333474958682669,16201959956328332048,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7220 /prefetch:8
                                                                                              8⤵
                                                                                              • Enumerates system info in registry
                                                                                              PID:6660
                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7212,i,1817345335837092983,18318130971032420046,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7188 /prefetch:8
                                                                                              8⤵
                                                                                                PID:6556
                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7364,i,2790196112282248689,12643717792393757188,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7236 /prefetch:8
                                                                                                8⤵
                                                                                                • Enumerates system info in registry
                                                                                                PID:6228
                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7392,i,15684682659114424850,16782669807317939082,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7208 /prefetch:8
                                                                                                8⤵
                                                                                                  PID:684
                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7200,i,12391357658043551384,11042010503023855830,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7756 /prefetch:8
                                                                                                  8⤵
                                                                                                    PID:7420
                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7764,i,2116805613404931188,3286395799771358574,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7748 /prefetch:8
                                                                                                    8⤵
                                                                                                      PID:7440
                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8328,i,11237183548593829485,8503292762603308973,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8344 /prefetch:8
                                                                                                      8⤵
                                                                                                      • Enumerates system info in registry
                                                                                                      PID:8264
                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8420,i,14519993170201483513,13542654492130223931,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8440 /prefetch:8
                                                                                                      8⤵
                                                                                                        PID:8272
                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8756,i,4711342768296002313,9339843561028342052,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8764 /prefetch:8
                                                                                                        8⤵
                                                                                                        • Enumerates system info in registry
                                                                                                        PID:8564
                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8472,i,7186532388498992153,10702833481344961546,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8468 /prefetch:2
                                                                                                        8⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Enumerates system info in registry
                                                                                                        PID:8348
                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8584,i,1751398919840912946,1036849827095935182,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8688 /prefetch:8
                                                                                                        8⤵
                                                                                                          PID:8572
                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8752,i,4447986244348589815,13629691114811731959,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8892 /prefetch:8
                                                                                                          8⤵
                                                                                                          • Enumerates system info in registry
                                                                                                          PID:8580
                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8368,i,7003422454159101212,2052448575407322033,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8884 /prefetch:8
                                                                                                          8⤵
                                                                                                            PID:8588
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8772,i,10637101871549345482,1891853262358182467,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=8920 /prefetch:8
                                                                                                            8⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:8596
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8828,i,5402271542234890249,1798263825834483360,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=8896 /prefetch:8
                                                                                                            8⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:8604
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8836,i,12823694567549125983,13631490878233987495,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=8932 /prefetch:8
                                                                                                            8⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:8612
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8788,i,3707976280763418925,18445217805066530630,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=8960 /prefetch:8
                                                                                                            8⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:8620
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8572,i,16232037565636335852,9436573362547302737,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8692 /prefetch:8
                                                                                                            8⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:8556
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8560,i,2056737389267255133,14729525468878753480,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8696 /prefetch:8
                                                                                                            8⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:8648
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
                                                                                                            8⤵
                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                            PID:8164
                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                                                                              C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff716b25598,0x7ff716b255a8,0x7ff716b255b8
                                                                                                              9⤵
                                                                                                                PID:5016
                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10412,i,2994792895856468812,1714247276377796703,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10416 /prefetch:8
                                                                                                              8⤵
                                                                                                              • Enumerates system info in registry
                                                                                                              PID:4368
                                                                                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10572,i,13746050000515537335,18061667111875856844,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10588 /prefetch:8
                                                                                                              8⤵
                                                                                                                PID:8656
                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=10780,i,8300999606550939248,8746303902537373857,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10796 /prefetch:1
                                                                                                                8⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Enumerates system info in registry
                                                                                                                PID:9016
                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10960,i,4279270605498549570,16425992391134348210,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10808 /prefetch:8
                                                                                                                8⤵
                                                                                                                  PID:8860
                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10988,i,6625129716472829333,4113205365725446570,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11124 /prefetch:8
                                                                                                                  8⤵
                                                                                                                    PID:8228
                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11252,i,2405177821813171953,10577039011008196353,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=10824 /prefetch:8
                                                                                                                    8⤵
                                                                                                                    • Enumerates system info in registry
                                                                                                                    PID:8540
                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe" --fix-taskbar-pins
                                                                                                                    8⤵
                                                                                                                    • Enumerates system info in registry
                                                                                                                    PID:9064
                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff653e06998,0x7ff653e069a8,0x7ff653e069b8
                                                                                                                      9⤵
                                                                                                                        PID:7336
                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4456,i,8915894671929652577,13390289486669694931,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=4440 /prefetch:8
                                                                                                                      8⤵
                                                                                                                        PID:7740
                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11392,i,7186474054564324046,14688751342707359183,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=10740 /prefetch:8
                                                                                                                        8⤵
                                                                                                                          PID:8396
                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11356,i,7842485567649836498,14651611351859279905,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=11388 /prefetch:8
                                                                                                                          8⤵
                                                                                                                            PID:8376
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11292,i,7518853469996845750,15349110876942661160,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11372 /prefetch:8
                                                                                                                            8⤵
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:6672
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11320,i,18292523084512519441,18429992547455306387,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=11376 /prefetch:8
                                                                                                                            8⤵
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:8440
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6528,i,6090759098977524887,16862599190519896448,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=6500 /prefetch:8
                                                                                                                            8⤵
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:8132
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6524,i,18166773717871649006,9051612103188799386,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=6464 /prefetch:8
                                                                                                                            8⤵
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:7768
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11288,i,11064309492320745805,3768327911734080234,524288 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=11324 /prefetch:8
                                                                                                                            8⤵
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:7292
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=4440,i,11806651961960850427,1573832550557314572,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=6504 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:6616
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=4396,i,13794834821116053316,3292405737826291817,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=3704 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:960
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=6648,i,12225867626636497754,13323493701417735216,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=11372 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:9184
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=7708,i,11014779609164239967,5414541299698360268,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=10348 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:8472
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=7704,i,13799358633523788700,853090518556386400,262144 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=2416 /prefetch:8
                                                                                                                            8⤵
                                                                                                                            • Network Service Discovery
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:212
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=1612,i,10184389351604409137,18209318865627137541,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=772 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:6500
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=5152,i,6678248310130488483,9481798606014879982,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=5744 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:6540
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7364,i,12619845259526890718,12239241682529989911,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=6912 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:7384
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=3368,i,4358584087943653621,17766489071033964419,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=3752 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:8112
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=7384,i,3655661049208050960,14028126243385514873,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=4252 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:1964
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=1136,i,14221751314073176871,6397897617943564145,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=824 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:5864
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=3716,i,8815452324921052140,5811259379394382397,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=3696 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:5048
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=10772,i,15286941565104367119,5979962264651714059,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=776 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:6000
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=11396,i,7530940182676471697,13063271581536920106,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=7632 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:6176
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=11072,i,8144590683696770877,15735931620171483014,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=5744 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:7692
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=7528,i,9403507883629943568,12982783980532429732,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709052841842773 --mojo-platform-channel-handle=4460 /prefetch:2
                                                                                                                            8⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:7800
                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --version
                                                                                                                            8⤵
                                                                                                                              PID:6476
                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                                                                9⤵
                                                                                                                                  PID:1392
                                                                                                                              • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
                                                                                                                                8⤵
                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                • Enumerates system info in registry
                                                                                                                                PID:6616
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff716b25598,0x7ff716b255a8,0x7ff716b255b8
                                                                                                                                  9⤵
                                                                                                                                    PID:7060
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=10604,i,7833128074880711081,14589257108644734048,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709053778884622 --mojo-platform-channel-handle=5456 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  PID:5756
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=3616,i,485593913889940497,7162523860879147769,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709054715926471 --mojo-platform-channel-handle=4432 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:8296
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=3392,i,11608635332321586296,1482819141526025045,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709055652968320 --mojo-platform-channel-handle=4252 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:4648
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=4452,i,4900625848907446861,14638208628862580357,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709056590010169 --mojo-platform-channel-handle=1600 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  PID:1408
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=10824,i,14800302681538848593,16182069135100087148,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709057527052018 --mojo-platform-channel-handle=10828 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:6012
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=11292,i,4667457981428901677,7409552572682405136,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709058464093867 --mojo-platform-channel-handle=11040 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:876
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=11072,i,7883174282954810690,11379182524810471972,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709059401135716 --mojo-platform-channel-handle=3700 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:788
                                                                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=10736,i,1064935905433701498,10813167483191445557,2097152 --field-trial-handle=2064,i,264020187557793136,3655861824409146824,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2068,i,11323322951779949393,10270067158370211517,4 --trace-process-track-uuid=3190709060338177565 --mojo-platform-channel-handle=11156 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  PID:5904
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"
                                                                                                                            5⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Writes a Windows system DLL name to a user directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4924
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe" --version
                                                                                                                            5⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5380
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x98c9cc,0x98c9d8,0x98c9e4
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3788
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6992,i,6177976227790512172,7267590138903354990,262144 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
                                                                                                                      2⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:3912
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5620,i,113461441749785416,9203391925877037302,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:6768
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7566166160406651433,16026181404787250300,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:9084
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11174696706966938684,17685407329413050758,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:9088
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8616,i,1839711903341366746,17649016796695247639,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:4808
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5348,i,17567561575851177603,10594551831594866733,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=1548 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:8228
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8684,i,16262262942407596403,279003883510237629,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:8068
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4368,i,16399793272314899458,18291085608519618706,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:7308
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8364,i,14976332335160978954,1286398449173612778,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:8688
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4312,i,2597136679087738799,13389141410231975871,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:8628
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8640,i,7386504501603171271,14870806731021323540,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:9208
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8440,i,8337817623735535912,12807132044191003106,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:6356
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8384,i,16266244051099683962,15519319874101453016,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:4368
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4320,i,13031940457097419869,12339317916716175250,2097152 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:7812
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,12425808833995023345,10768818220687334424,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:3912
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,11559762682107339578,11651010703260590201,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:7196
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,8062486287179339366,6940962357630781310,524288 --field-trial-handle=2220,i,725177736281724204,16562178459231756848,262144 --variations-seed-version --mojo-platform-channel-handle=1528 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3900
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2596
                                                                                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
                                                                                                                                                      1⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:3524
                                                                                                                                                    • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                                                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                        PID:6440
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                        PID:6248
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Programs\Opera\136.0.6008.80\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x234,0x238,0x23c,0x230,0x240,0x7ffcecb6bdb0,0x7ffcecb6bdc0,0x7ffcecb6bdd0
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:7144
                                                                                                                                                      • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:6888
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC1
                                                                                                                                                          1⤵
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          PID:7156
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.80 --initial-client-data=0x274,0x278,0x27c,0x210,0x280,0x7ff716b25598,0x7ff716b255a8,0x7ff716b255b8
                                                                                                                                                            2⤵
                                                                                                                                                              PID:8536
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                                                                                                                                              2⤵
                                                                                                                                                                PID:8112

                                                                                                                                                            Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                  Reconnaissance

                                                                                                                                                                  Resource Development

                                                                                                                                                                  Initial Access

                                                                                                                                                                  Execution

                                                                                                                                                                  Persistence

                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1547

                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                  1
                                                                                                                                                                  T1547.001

                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1546

                                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                                  1
                                                                                                                                                                  T1546.015

                                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                                  1
                                                                                                                                                                  T1574

                                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                                  1
                                                                                                                                                                  T1574.001

                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1547

                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                  1
                                                                                                                                                                  T1547.001

                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1546

                                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                                  1
                                                                                                                                                                  T1546.015

                                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                                  1
                                                                                                                                                                  T1574

                                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                                  1
                                                                                                                                                                  T1574.001

                                                                                                                                                                  Defense Evasion

                                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                                  1
                                                                                                                                                                  T1574

                                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                                  1
                                                                                                                                                                  T1574.001

                                                                                                                                                                  Masquerading

                                                                                                                                                                  1
                                                                                                                                                                  T1036

                                                                                                                                                                  Match Legitimate Name or Location

                                                                                                                                                                  1
                                                                                                                                                                  T1036.005

                                                                                                                                                                  Modify Registry

                                                                                                                                                                  3
                                                                                                                                                                  T1112

                                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                                  1
                                                                                                                                                                  T1553

                                                                                                                                                                  Install Root Certificate

                                                                                                                                                                  1
                                                                                                                                                                  T1553.004

                                                                                                                                                                  Credential Access

                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                  1
                                                                                                                                                                  T1555

                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                  1
                                                                                                                                                                  T1555.003

                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                  1
                                                                                                                                                                  T1552

                                                                                                                                                                  Credentials In Files

                                                                                                                                                                  1
                                                                                                                                                                  T1552.001

                                                                                                                                                                  Discovery

                                                                                                                                                                  Browser Information Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1217

                                                                                                                                                                  Network Service Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1046

                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                  2
                                                                                                                                                                  T1120

                                                                                                                                                                  Query Registry

                                                                                                                                                                  7
                                                                                                                                                                  T1012

                                                                                                                                                                  System Information Discovery

                                                                                                                                                                  6
                                                                                                                                                                  T1082

                                                                                                                                                                  System Location Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1614

                                                                                                                                                                  System Language Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1614.001

                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1016

                                                                                                                                                                  System Time Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1124

                                                                                                                                                                  Lateral Movement

                                                                                                                                                                  Collection

                                                                                                                                                                  Data from Local System

                                                                                                                                                                  1
                                                                                                                                                                  T1005

                                                                                                                                                                  Command and Control

                                                                                                                                                                  Exfiltration

                                                                                                                                                                  Impact

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  opera-one-dark.jpg
                                                                                                                                                                  • Path C:\Program Files\scoped_dir6256_1002409209\opera-one-dark.jpg
                                                                                                                                                                  • Size 349KB
                                                                                                                                                                  • SHA256 70b35d024405f6adfb37715e58cadeefab36e305158a73e8a4cc377bae1a4476
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  persona.ini
                                                                                                                                                                  • Path C:\Program Files\scoped_dir6256_1002409209\persona.ini
                                                                                                                                                                  • Size 217B
                                                                                                                                                                  • SHA256 69feb09a5aa11d2badb4cdf17c2ddf7861a97a1d3a6add0ded22e5e9e07defc5
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  opera-one.jpg
                                                                                                                                                                  • Path C:\Program Files\scoped_dir6256_430817023\opera-one.jpg
                                                                                                                                                                  • Size 194KB
                                                                                                                                                                  • SHA256 2e8375c8ba1c0f5379de54bf4bcb0af7ae0ef3c2a6af07409c8d007ff0685b71
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  persona.ini
                                                                                                                                                                  • Path C:\Program Files\scoped_dir6256_430817023\persona.ini
                                                                                                                                                                  • Size 207B
                                                                                                                                                                  • SHA256 7cd803353a8af5af891ddf63908e408d1667cfc4b4d2882c61a0fe734df919ec
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                                  • Size 471B
                                                                                                                                                                  • SHA256 f4c81da45da3889780c4e61596bdbc7544a9306861551a6634dae51963e36fd2
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                                  • Size 416B
                                                                                                                                                                  • SHA256 c07e8afc69d652998993482f7a1377bfebb9beb028ad28bcdc64dda7051de4b6
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  settings.dat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                  • Size 280B
                                                                                                                                                                  • SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  settings.dat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                  • Size 280B
                                                                                                                                                                  • SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  LOG.old
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                  • Size 331B
                                                                                                                                                                  • SHA256 2c5b50a4f675de414f0248e60eb2a9b5da3a189ce6a1d200964b6fba303c8605
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  LOG.old
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                  • Size 334B
                                                                                                                                                                  • SHA256 58bd44c7c9321ab78d7b9780470e096ebf50f05eae78e8498dcd74abe89a40d2
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  f_00007f
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
                                                                                                                                                                  • Size 346KB
                                                                                                                                                                  • SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  f_000081
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
                                                                                                                                                                  • Size 55KB
                                                                                                                                                                  • SHA256 edf8897b2fb098d33361e2c26f52fd2a1b767e7e4661cd3e558c345c23eff922
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  f_000091
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
                                                                                                                                                                  • Size 23KB
                                                                                                                                                                  • SHA256 1cae5bad340b07ad22b610e9718e260dc1f7731244d80b17ccca29e5a1c83f31
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 5KB
                                                                                                                                                                  • SHA256 f49476fa683aa83a18d8c8c2dbb97bb414675f4ec8fa466c8207091419ff9f4e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 5KB
                                                                                                                                                                  • SHA256 d54217a6e7aa1b159e6d5eba54fd16898d5efeb10586a5e47bdca4b84a68efb0
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 6KB
                                                                                                                                                                  • SHA256 02dbaa56b1477698d75e9a7409181f0c73d2de4c4995d9233776b2dfeb516c39
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 5KB
                                                                                                                                                                  • SHA256 a4c6ded63e96e218d29f71604140d9f2cbbb94199d7440d960da2a2bafb93afe
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index~RFe5941b2.TMP
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5941b2.TMP
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 75a2518fb2751e68095910e1843474995358870fa6b9dcd32fe6fd6cae35de94
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Edge Profile.ico
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                  • Size 70KB
                                                                                                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  18d1cdc5-0ece-4916-8cee-1f8ff6c3255e.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18d1cdc5-0ece-4916-8cee-1f8ff6c3255e.tmp
                                                                                                                                                                  • Size 2B
                                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Network Persistent State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                  • Size 14KB
                                                                                                                                                                  • SHA256 adfe974aceeb5f66121f7e97eab2584d267702d6b0fe48a7f3d7d9dfd656d2e6
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Network Persistent State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                  • Size 111B
                                                                                                                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Network Persistent State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                  • Size 19KB
                                                                                                                                                                  • SHA256 a274df99c3b0a6e183a4628c9f24ffb3dc106e59ddd1ba955e20e5acc8304335
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Network Persistent State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                  • Size 17KB
                                                                                                                                                                  • SHA256 d84ae56f3f4fb379adc08f11e951998829dc4fcec63e56e1afdee938d18298d4
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Network Persistent State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                  • Size 17KB
                                                                                                                                                                  • SHA256 1d14f57aa0f30596263049a775049c5d339180ae9a55ea951c3f2cb14d271e15
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 764aab344f6640bdf4b9aba0af926c236461da945dd782e1da9e09785f81a9f2
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 7d50b52106b9be977b6efe3f08c33dcfcd284e395fdbd7034413a7e16a47dd08
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 5e96ed26bb44fd392da1166ac81e0182e24838211e4ef2b79297c0abb85ff93a
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 12KB
                                                                                                                                                                  • SHA256 f5bd7eac2f551d4a088d88cb619db1eac936d96ffdc2380a97da3042c3df40f0
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 575e6b8a479ea0d187f11178f2bfa28f41cda1f56b6714511968abdca85658a3
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 11KB
                                                                                                                                                                  • SHA256 9dc3168af090e5d329e13960df6a2dd1351994078551d140124afb4ba652c96f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 11KB
                                                                                                                                                                  • SHA256 8160f3c6e7c0f4245306488bb5adf98a4d8509858e2f03a24869ba0e92b233eb
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 12KB
                                                                                                                                                                  • SHA256 4ce61f757c99e860643ee0fee8a4f23db72bae6362e23c042029346b48d88932
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 12KB
                                                                                                                                                                  • SHA256 46394dcdbc66a8382ac36cabf2f4fa651c405f1437741698b8a9a9311aba5ce3
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 332a55558b4fad63ea0d8f9131a6b1ee6bf963b669ca9cb9b0312fd77bc9a929
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 12KB
                                                                                                                                                                  • SHA256 077ceace3722be318e4b5ad063ec975570d87c9b892eeef0c0e4e3e9aaaf9040
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                  • Size 26KB
                                                                                                                                                                  • SHA256 2dfbdd276a0f314c683de500678194d10fbf92c5e4d6cbc6987b45a07f3c5899
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Secure Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                  • Size 27KB
                                                                                                                                                                  • SHA256 a1269a0abf81d54430c304a07cdcbbf2e5b74405ccc3be68debaf04f62a4ba5e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  temp-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c25285b0-0820-4373-b90c-b7da29e72a5d\index-dir\temp-index
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 57d56cbc4a5216e3d7c7759095597cd5d0034ca2cf57b63df210508ded32aa91
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index~RFe5d0aff.TMP
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c25285b0-0820-4373-b90c-b7da29e72a5d\index-dir\the-real-index~RFe5d0aff.TMP
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 d96f0070bea24a8a1a8a772380e235144d3e41e5ebf148ceca38989e8566b722
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  index.txt
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                  • Size 371B
                                                                                                                                                                  • SHA256 71297a2e9b885efa211b21352a3c9f4d24919fe5d4fb9d99e1d47738c831e568
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  .usage
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
                                                                                                                                                                  • Size 24B
                                                                                                                                                                  • SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  CURRENT
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
                                                                                                                                                                  • Size 16B
                                                                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  index.txt
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                                                                                                                                                  • Size 88B
                                                                                                                                                                  • SHA256 c9bc3e5c576605658995b577429a128c9911e7bba285d1b01d4f163753168672
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  index.txt~RFe58ecad.TMP
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58ecad.TMP
                                                                                                                                                                  • Size 175B
                                                                                                                                                                  • SHA256 3cf0b4d7e35ce37c91609a6c3a06eddaa160d2ab150fd58994410187954c06bb
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  00000000
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\FileSystem\t\00\00000000
                                                                                                                                                                  • Size 1B
                                                                                                                                                                  • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  favorites_diagnostic.log
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 f19774873999940a6b2ab438fc027093cc39a9809c3e7d84d7db5ad10f1fcd8e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  OperationConfig
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                  • Size 22KB
                                                                                                                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  OperationConfig~RFe5957cb.TMP
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5957cb.TMP
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                  • Size 18KB
                                                                                                                                                                  • SHA256 63cfe40ad60444784a3f8dadb73415b5398b6131281dcb07878e0e1565733f1e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                  • Size 26KB
                                                                                                                                                                  • SHA256 0af0bc7b685a6c3f78c98e1759c1318bdab41bebc54f2fa261c72872bc0921e7
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 610acc635154e13a72d6ce86fee91450925a7ba9db573290260808b3d44077bb
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                  • Size 26KB
                                                                                                                                                                  • SHA256 e5d6221a4a0704fc7fc4ebee4fdbf7cb1ea4643d09613477fd5670af3eb22cd6
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                  • Size 18KB
                                                                                                                                                                  • SHA256 54bbb553ec7b5b0c8563d63ca983d75bbf258a2c10976e5c0e5160cd2531532b
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                  • Size 26KB
                                                                                                                                                                  • SHA256 0fc641818c5a4ff9e53fe810f898d4f907486758c2c159eed2581dcbeb7cce73
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 8afefaf2cc060e322c0d7b81ec76b8b13885f24c5be40a900d3ae29b891c04a9
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  RevisitationBloomfilter
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                  • Size 392B
                                                                                                                                                                  • SHA256 3ba76b2a4e56458bdb55d57edb777871db381966dec6c109f606761d56a83a92
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  RevisitationBloomfilter
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                  • Size 392B
                                                                                                                                                                  • SHA256 e0faa742b93c381b9e61ef5fccc566e41a1267329d47cc14fb5906df37903c5a
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  RevisitationBloomfilter
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                  • Size 392B
                                                                                                                                                                  • SHA256 a958f0eee17afc23664d4aafd932f5862e086efe4405da8ee8446766b1df00cc
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  RevisitationBloomfilter
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                  • Size 392B
                                                                                                                                                                  • SHA256 28691bf739be2501b010c29bd602c8ff25584d86afab065ae0067b359194171b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  RevisitationBloomfilter
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                  • Size 392B
                                                                                                                                                                  • SHA256 2916eba1f525ab02aa8a929978f7416a3e33098a6c56398d73bb690046a8f937
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  RevisitationBloomfilter~RFe59cc9d.TMP
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59cc9d.TMP
                                                                                                                                                                  • Size 392B
                                                                                                                                                                  • SHA256 7b6804a043defb8b0a0526e747040e03c230ddd060abfaee96c98b80fc62decb
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  6902ee75-ab25-48bb-99a1-b287ce81ecb9.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6902ee75-ab25-48bb-99a1-b287ce81ecb9.tmp
                                                                                                                                                                  • Size 13B
                                                                                                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 1f337175268be0ffa0300cc8cbbc8ac5a303b0c9a8c35e6c745d542b96f1f189
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  data_0
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_0
                                                                                                                                                                  • Size 44KB
                                                                                                                                                                  • SHA256 c8b86852b3b9cd3fd2a2410932e20aa3bd3cc983770d401c2133661eca97d7dd
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  data_2
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_2
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                  Submit Download

                                                                                                                                                                  data_3
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\data_3
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                  Submit Download

                                                                                                                                                                  installer_prefs.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 f461f6ba9b87051d386ffe338dcc85f5c8f5c5f26cc887d8c6d56cc081b8e0a9
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  opera.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                                                                                                                                  • Size 3.4MB
                                                                                                                                                                  • SHA256 0dfe554610f3224f31239479931f1b1a5addac7c3068ab8d39ee72f90b78aa7e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Opera Browser.lnk
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\Opera Browser.lnk
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 452fbf08728d5e549c1cdd68f36d19635cea1ef3d194a2a99cab2301e3890853
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  additional_file0.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\additional_file0.tmp
                                                                                                                                                                  • Size 2.9MB
                                                                                                                                                                  • SHA256 30786977e61add36f7c641facfb7fce1b2ec7c2a0a7e055a172f127a68788556
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  assistant_installer.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\assistant_installer.exe
                                                                                                                                                                  • Size 2.4MB
                                                                                                                                                                  • SHA256 e8dce277d6edb918499526fadba9902e317496c2af077219f263a7a643467824
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  dbgcore.dll
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\dbgcore.dll
                                                                                                                                                                  • Size 196KB
                                                                                                                                                                  • SHA256 c16220edd3787da33dbd3ac2fcbec7de6a13e2baf14ae6105bba68d4efd83628
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  dbghelp.dll
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\assistant\dbghelp.dll
                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                  • SHA256 990b13e88b4a9985eb5c596078e2ec26a0edcc22169dd71f8a84c7943005306c
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  installer_prefs_include.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\installer_prefs_include.json
                                                                                                                                                                  • Size 279B
                                                                                                                                                                  • SHA256 4ec2140ade86f38f637a2f869c41136e99f872a9f9bc07fb17e339508440e97e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  installer_prefs_include.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\installer_prefs_include.json
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 8c5330895e19d6ad31f663a7870b98f7021f22af28b6e84d5aaf799ba30a212a
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  installer_prefs_include.json.backup
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\526aae18-7083-49d8-a4d1-3860a9c129e8 Opera Installer Temp\opera_package_202609301518211\installer_prefs_include.json.backup
                                                                                                                                                                  • Size 264B
                                                                                                                                                                  • SHA256 44c54307dfec9d9f2bc9a8d53b99979e5e2d6542792b92344d1e3a6de2fb0cbf
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  installer.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS8BBA78B9\installer.exe
                                                                                                                                                                  • Size 8.3MB
                                                                                                                                                                  • SHA256 20b18b3c0b48d9ee2776e3972e1d4215c5b715be7d4d895caa4d3e445d12beb5
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  OpInst.exe
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                                                                                                                                                                  • Size 3.1MB
                                                                                                                                                                  • SHA256 1f158dc17044e48734bc9aa9ab309008c44da974ecde052cf9cd4d2664d3b8de
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  bg.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\bg.png
                                                                                                                                                                  • Size 224KB
                                                                                                                                                                  • SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  favicon_opera_one.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3656_236273602\CRX_INSTALL\favicon_opera_one.png
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  de932af914ba00303d4a2778a383ac9c831101e2.crx
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3656_236273602\de932af914ba00303d4a2778a383ac9c831101e2.crx
                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                  • SHA256 e81986014a4fb55c0aa220745d2433c51ad29166b32693de8911784dd3920584
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Icon_Light_Neutral.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6256_164298977\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  dcc53e23-1340-4519-bbcf-e13af8c37c15.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6256_164298977\dcc53e23-1340-4519-bbcf-e13af8c37c15.tmp
                                                                                                                                                                  • Size 2.6MB
                                                                                                                                                                  • SHA256 19bc35ca347a6560c0183e56da6bee3353737e78aa9eff9111c5ebd897b0cfd5
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  13c7c573-f7dc-4fe3-9760-e8fd1f258bcf.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6256_2046798405\13c7c573-f7dc-4fe3-9760-e8fd1f258bcf.tmp
                                                                                                                                                                  • Size 13KB
                                                                                                                                                                  • SHA256 ce8adf970c3290b7ea94c85727c5abe7eb232e16026a1f8f876ad7f3ec03573d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  cf646a7f-e2d1-4c71-9ab6-a2cd42b09eeb.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6256_38935652\cf646a7f-e2d1-4c71-9ab6-a2cd42b09eeb.tmp
                                                                                                                                                                  • Size 46KB
                                                                                                                                                                  • SHA256 176a736c95c08746480a0e25f7acf323d502d0f6aac4b4dfbeb2713513af8a52
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                                                  • Size 401B
                                                                                                                                                                  • SHA256 9ad8ffac49958d5bf771eb6f0bd7462b32597696c9d0a45ade771ef8c124b1bb
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\CRX_INSTALL\_locales\en_GB\messages.json
                                                                                                                                                                  • Size 387B
                                                                                                                                                                  • SHA256 554cbb0514a7897ebe50043e0de9fabfcf321dcbd3c39e77cb96e62d871c7bc3
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\CRX_INSTALL\_locales\es_419\messages.json
                                                                                                                                                                  • Size 424B
                                                                                                                                                                  • SHA256 b04b308252b490b9555e5e002c5c6da63f3a6d517e2f659a626a500467e21100
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  manifest.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\CRX_INSTALL\manifest.json
                                                                                                                                                                  • Size 4KB
                                                                                                                                                                  • SHA256 dee09929862d037e825b73576a80272b344d7c8e90a3d245a658f5b54486e9d7
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  pipeline.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\CRX_INSTALL\source\shaders\pipeline.json
                                                                                                                                                                  • Size 146B
                                                                                                                                                                  • SHA256 9e4ae1e22f4ebc23b914d04a4d0cd0b79639dfa609d830b62cc0285dc4a95bba
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  accent.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\CRX_INSTALL\wallpaper\color_picker\accent.png
                                                                                                                                                                  • Size 99KB
                                                                                                                                                                  • SHA256 0ba039580d11744514f1734bd6ed144bcd8ef605f61b9c4c2fa300a5afae3348
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  background.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\CRX_INSTALL\wallpaper\color_picker\background.png
                                                                                                                                                                  • Size 70KB
                                                                                                                                                                  • SHA256 44cb4f1b7692d39f251bd2dd24352fff8ce8d9b2bcc47506e642ee4dd3f96f11
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  additional_file2.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7172_1616512587\additional_file2.tmp
                                                                                                                                                                  • Size 937KB
                                                                                                                                                                  • SHA256 73355e09adb2bbb96a8e146e1098ad18036d58353d87f78cf4e6183c1f8fa8a6
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Size 12KB
                                                                                                                                                                  • SHA256 39c0d3964a749cff894362c4f9f34ea71924e8451c7dc579223a42b15a90bc67
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Size 14KB
                                                                                                                                                                  • SHA256 d59bea996c5aba39c3e9b60bf3eeb76c70b3c7ea0583d6ec119d4af85cbc92ff
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Size 16KB
                                                                                                                                                                  • SHA256 719f5a76504a8d81c561cfd762879d68d888eb46c3a8d41f9260769ec9e582a6
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                  • Size 16KB
                                                                                                                                                                  • SHA256 1567055b48a3c7af73d31b32237e9802c8327a93a1bc5a6cdbe2f51b6e568ae0
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  62e81678-46a0-4cc5-b808-18c9e4d36971.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\62e81678-46a0-4cc5-b808-18c9e4d36971.tmp
                                                                                                                                                                  • Size 150B
                                                                                                                                                                  • SHA256 630ca5068ab7a05d2324d1c36454385a94285e267e92e669c5b815e0ef5b464b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  settings.dat
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                                                                  • Size 40B
                                                                                                                                                                  • SHA256 85d4b696e6456942c6fdd9375b2684dde1f5ab3ce2f1bd7b4b9874adab189bf7
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  3fd6636d-e90c-4d64-a28b-5b68eca38850.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\3fd6636d-e90c-4d64-a28b-5b68eca38850.tmp
                                                                                                                                                                  • Size 203B
                                                                                                                                                                  • SHA256 b9e563c06751b14dd8af966fadc8e5f332247e6ae7f5d7d1424b95b4b6eebfc0
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  BookmarkMergedSurfaceOrderingb41fd1fb-c13a-4e3c-a92d-5d3f8a5007a9.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarkMergedSurfaceOrderingb41fd1fb-c13a-4e3c-a92d-5d3f8a5007a9.tmp
                                                                                                                                                                  • Size 6B
                                                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Bookmarks
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Bookmarks
                                                                                                                                                                  • Size 36KB
                                                                                                                                                                  • SHA256 71abc336f5eb407b5d0d5b5105d74962fa818b3319cfd23ba677c261fa99243a
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  BookmarksExtras
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtras
                                                                                                                                                                  • Size 197KB
                                                                                                                                                                  • SHA256 9ae3beea5705490203556c42ebb2568fec6fc435b3315cd33956e872a898344b
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  BookmarksExtras00f30d62-17b4-4261-a12a-466f0c457abc.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtras00f30d62-17b4-4261-a12a-466f0c457abc.tmp
                                                                                                                                                                  • Size 2B
                                                                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 48B
                                                                                                                                                                  • SHA256 5107b4a7d0289bee694c7cf7e8eba9c536ddbc85de1f5755646c5bb8e14454f8
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 336B
                                                                                                                                                                  • SHA256 ae392892bf1338e8317eb44af4d9834f7319a95f87115ec9a0674d470c7a75ba
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 336B
                                                                                                                                                                  • SHA256 0097e661d0711a64dad96d68f6f60630bc1796ca6f7b05ff99674173e08cb355
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                  • Size 744B
                                                                                                                                                                  • SHA256 982cad94a2d997715fd7ce6e4ce40aca239ba61d6d3bd22b47e833970fd161fe
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\bg\messages.json
                                                                                                                                                                  • Size 580B
                                                                                                                                                                  • SHA256 f1b238d97566981d936945e64c0066b1d4fd3f6392c16ac0463d3b46fd468714
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\bn\messages.json
                                                                                                                                                                  • Size 809B
                                                                                                                                                                  • SHA256 80a4c1efe951aa776823557a3c49b8fcd62af49a14380a318818e3d0fddd214f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\ca\messages.json
                                                                                                                                                                  • Size 423B
                                                                                                                                                                  • SHA256 f94aaf624b73b7969b44341b56e593ffa6deccd92169d1bac059000db337acac
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\cs\messages.json
                                                                                                                                                                  • Size 407B
                                                                                                                                                                  • SHA256 2819387ac23ec4550a3778be820522a7fbf0d36d4859c0c057eddb199e4e41d9
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\da\messages.json
                                                                                                                                                                  • Size 393B
                                                                                                                                                                  • SHA256 3f9a707d9d1489662efc26127b48b5eaf4df20e32b40b73d4a334b772f0c92c4
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\de\messages.json
                                                                                                                                                                  • Size 425B
                                                                                                                                                                  • SHA256 18093b5c5134109d7e7528fa6a92ed1adf36b351fc32f37158bc88064e541a0b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\el\messages.json
                                                                                                                                                                  • Size 624B
                                                                                                                                                                  • SHA256 6f10347307c2d5c1fab911bc6ce07c6edea922bb0ec575cc908bdfd4accbec8d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\fi\messages.json
                                                                                                                                                                  • Size 412B
                                                                                                                                                                  • SHA256 f886a0f236c6741488d6b001717f1b50dc36863365ee42692b3cf36abbc2334e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\fil\messages.json
                                                                                                                                                                  • Size 423B
                                                                                                                                                                  • SHA256 2c5501932616f21b4523f18bbbffff896a16e993b2a482bb8a8961e8d15b20d4
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\fr\messages.json
                                                                                                                                                                  • Size 435B
                                                                                                                                                                  • SHA256 6c5b067f98cf71722061022118e825cb753050833c1079c06809c1eb92e68737
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\hi\messages.json
                                                                                                                                                                  • Size 700B
                                                                                                                                                                  • SHA256 7ef2c7ab8bb7f1fb2b52901fc7a7f0e09eac95a6ef1bfea818dace4484fdcba7
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\hr\messages.json
                                                                                                                                                                  • Size 423B
                                                                                                                                                                  • SHA256 00780fca6c30710c79858b69990c0f6dddc3b2d46cb759202ce66da11c85bb6b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\hu\messages.json
                                                                                                                                                                  • Size 440B
                                                                                                                                                                  • SHA256 c5f9301cd0674e4a184436e5dc26879c980baf66bcf0c201b010e26325ea6e9b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\id\messages.json
                                                                                                                                                                  • Size 391B
                                                                                                                                                                  • SHA256 14f3c6f716b3e99165d5388121f6ed901c1f5acb05420c1573c9e513769bd26b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\it\messages.json
                                                                                                                                                                  • Size 427B
                                                                                                                                                                  • SHA256 50f996c101f2e54fe0f2c88172c259abe05b7705a7b13ff049fd807a4399bb23
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\ja\messages.json
                                                                                                                                                                  • Size 504B
                                                                                                                                                                  • SHA256 db19d6d58fb03ce604d9c0840c08707d3948e16682aee6312af2a39d954c7196
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\ko\messages.json
                                                                                                                                                                  • Size 440B
                                                                                                                                                                  • SHA256 00b0041d93c2f2760e964a70dc3dfbbe720a3f261bda6e5ff6f052106f4628ad
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\lt\messages.json
                                                                                                                                                                  • Size 428B
                                                                                                                                                                  • SHA256 2a53a1eb30e70423e4c146c3ffa96ead6d1f1b154059e8de7ec7a5960f2686d1
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\lv\messages.json
                                                                                                                                                                  • Size 421B
                                                                                                                                                                  • SHA256 3b37352b3d148d7295cc0a124da57f7dbac4e98c19c7f31dd8abf2d97726d886
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\ms\messages.json
                                                                                                                                                                  • Size 401B
                                                                                                                                                                  • SHA256 0def86e8de9487a64067843a8d672c027fa1b5c59e10cc60e0f08e2128dec96d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\nl\messages.json
                                                                                                                                                                  • Size 413B
                                                                                                                                                                  • SHA256 07962fa5344089532f5eca07d17319610f18b573cf2a0dd24cdef3b3261e6477
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\no\messages.json
                                                                                                                                                                  • Size 393B
                                                                                                                                                                  • SHA256 d3c23b53ef4f66d8b8730a570135a9a17f1414a15386b0d007e77287ecb788f3
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\pl\messages.json
                                                                                                                                                                  • Size 431B
                                                                                                                                                                  • SHA256 8a5de8af653b76691d07c35ea43c4f30c144982db249f020627cb78d9a9ed4e8
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\pt_BR\messages.json
                                                                                                                                                                  • Size 419B
                                                                                                                                                                  • SHA256 b292fb9f8c4a8c733e033fb8f85cc940a8b34cfdc349e7e54a3b8ec13aeac253
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\pt_PT\messages.json
                                                                                                                                                                  • Size 422B
                                                                                                                                                                  • SHA256 3baf77d76ae8fbeba0ac863f8e22c7d22084cf254feea227f37736f7a142b068
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\ro\messages.json
                                                                                                                                                                  • Size 433B
                                                                                                                                                                  • SHA256 e090811708241a42ab71f0f2e5f94c5a0e55a5d38a9ccacf7e4bd33ed8865574
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\ru\messages.json
                                                                                                                                                                  • Size 609B
                                                                                                                                                                  • SHA256 85017824ddfefe0789b0480bced2ae1fe1876c01b3adf7d033a16c6407d90ed6
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\sk\messages.json
                                                                                                                                                                  • Size 423B
                                                                                                                                                                  • SHA256 5bf2b036a0036d4bcdcc414d82b33aa83163cb9c8341f884c2648d7fa8aa333a
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\sr\messages.json
                                                                                                                                                                  • Size 578B
                                                                                                                                                                  • SHA256 4f724533cdf53b2ed7d49f185a43aa18b34a14170e0d67ebd61d4e745491ea02
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\sv\messages.json
                                                                                                                                                                  • Size 406B
                                                                                                                                                                  • SHA256 9bdc0eb2048e133c2410e2352245c5232d85c85db94a9708e493000a02762d22
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\sw\messages.json
                                                                                                                                                                  • Size 422B
                                                                                                                                                                  • SHA256 d487bcbfe9f0b6f87617fa6c4db5829d2de348a56417cfdafe310e5cf358c53a
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\ta\messages.json
                                                                                                                                                                  • Size 778B
                                                                                                                                                                  • SHA256 22d933c85b88d6b20e6ae9347fff17114320cc47cb4a6231ad88aa71394f6011
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\te\messages.json
                                                                                                                                                                  • Size 796B
                                                                                                                                                                  • SHA256 40c84d74e36686384d7adec3363be5b0e5a87809acae39432eddfdbc62e7dbd4
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\th\messages.json
                                                                                                                                                                  • Size 666B
                                                                                                                                                                  • SHA256 b80044e94b480c10470c6edf5dd260bd46540493b526130d8b2a03ea8acab41f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\tr\messages.json
                                                                                                                                                                  • Size 422B
                                                                                                                                                                  • SHA256 b262410f023e09dff8b4d81d074b091a73eb394a1db13f13f2878aa0b4f3fa38
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\uk\messages.json
                                                                                                                                                                  • Size 571B
                                                                                                                                                                  • SHA256 0bfcebd61e9aaafc456589ce18b73af1fb1d933406bb6f11e2f765c1e3d31f12
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\vi\messages.json
                                                                                                                                                                  • Size 479B
                                                                                                                                                                  • SHA256 879d1c47b51ea4bba46e72a57d129331ed3b71cb6a8d545fcf5ee73a2d240840
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\zh_CN\messages.json
                                                                                                                                                                  • Size 379B
                                                                                                                                                                  • SHA256 7fd0ceac426fbff6088de114f2e1a238f2d6842de027217525096c674cb17e72
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  messages.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\_locales\zh_TW\messages.json
                                                                                                                                                                  • Size 379B
                                                                                                                                                                  • SHA256 25f70a0f5f7f5267b0ee8cd52e233f4b69f82d9cb46a3dc24c169ce4627f5841
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  background.js
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\background.js
                                                                                                                                                                  • Size 264B
                                                                                                                                                                  • SHA256 1eed9d8fb6eb9f836709c8f0866ffa71fd5de7b9df7d1e8da1bb9c2011196e45
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  icon.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\icon.png
                                                                                                                                                                  • Size 5KB
                                                                                                                                                                  • SHA256 f355f2b3167c6c63bb570444d5e2db91f08a6903339a48f30e9d8eba233396e5
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  frag.wgsl
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\source\shaders\frag.wgsl
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 a02382715dd48479a3a25186bdf3ccd41279a8ee476d9071ba9212951933a3c4
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  vert.wgsl
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\source\shaders\vert.wgsl
                                                                                                                                                                  • Size 332B
                                                                                                                                                                  • SHA256 2cc3a249276241a39f3b82904d56a64ffa9b6eafb0b95385f5a2442f24ce15f7
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  mainTex.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\source\textures\mainTex.png
                                                                                                                                                                  • Size 139KB
                                                                                                                                                                  • SHA256 05e915df1184ec1e9f3e6dcb264d25095046b04bcbc8606b3bac61f8e826cb8f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  secTex.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\source\textures\secTex.png
                                                                                                                                                                  • Size 137KB
                                                                                                                                                                  • SHA256 6a7c66eef9773ec113aca4d5cd64f3f3aa49d4c534dc14fa985d707396223f2e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  preview.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\Temp\scoped_dir7172_1280365564\CRX_INSTALL\wallpaper\preview.png
                                                                                                                                                                  • Size 464KB
                                                                                                                                                                  • SHA256 c5a2b18b255c6a4029de97ef9d00af6e563b562a2abdbee1e934ff77d5a92c29
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  main.js
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.8_0\main.js
                                                                                                                                                                  • Size 47KB
                                                                                                                                                                  • SHA256 9cc5e1dd96d76735499257c52d632a0a9e17ed4da929035067dadcc586000335
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  logo_128.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_128.png
                                                                                                                                                                  • Size 7KB
                                                                                                                                                                  • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  logo_16.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_16.png
                                                                                                                                                                  • Size 653B
                                                                                                                                                                  • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  logo_32.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_32.png
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  logo_48.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_48.png
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  logo_64.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\icons\logo_64.png
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  service-worker-loader.js
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\service-worker-loader.js
                                                                                                                                                                  • Size 49B
                                                                                                                                                                  • SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  favicon_opera_one.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68_0\favicon_opera_one.png
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  reader_mode.js
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68_0\reader_mode.js
                                                                                                                                                                  • Size 112KB
                                                                                                                                                                  • SHA256 17f8a5c1d70acee668cc6964317d88802d4409c32b0d7e292b95e1de8ddb16df
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  spotify_frame_interceptor.js
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68_0\spotify_frame_interceptor.js
                                                                                                                                                                  • Size 5KB
                                                                                                                                                                  • SHA256 895ef6ae0efde6f5e8af23d1acbfac4a5351bda31c89d2e64c05f2de0181dd56
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  background.js
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\background.js
                                                                                                                                                                  • Size 87KB
                                                                                                                                                                  • SHA256 b199d4f989c63947c53a9d07450038cfe274b7a10e8cc7d688c4049ae14ef63e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Icon_Light_Neutral.png
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\128\Icon_Light_Neutral.png
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  popup.js.LICENSE.txt
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\popup.js.LICENSE.txt
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  rules.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\rules.json
                                                                                                                                                                  • Size 839B
                                                                                                                                                                  • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  1a93cbec-58e4-4ee5-9d02-3d05488902b9.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\1a93cbec-58e4-4ee5-9d02-3d05488902b9.tmp
                                                                                                                                                                  • Size 27KB
                                                                                                                                                                  • SHA256 1b6cb01715a2de1373f9f3e194921621463532558767bb5d6e1902e9b368ca5c
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  1e60365d-befb-4a14-88d6-b43f59042c80.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\1e60365d-befb-4a14-88d6-b43f59042c80.tmp
                                                                                                                                                                  • Size 27KB
                                                                                                                                                                  • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  5511318d-0759-4778-b5dc-84ee9eda5b6c.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\5511318d-0759-4778-b5dc-84ee9eda5b6c.tmp
                                                                                                                                                                  • Size 27KB
                                                                                                                                                                  • SHA256 3c5dfa15d581def92644fe4db0be64e2884f7f7ad01ec81671acdd44c70efcd4
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  6e30cf44-b90f-4a07-8151-90917e03cfd3.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\6e30cf44-b90f-4a07-8151-90917e03cfd3.tmp
                                                                                                                                                                  • Size 27KB
                                                                                                                                                                  • SHA256 aaa2c3089c7623aefb9025744747ec651dfa14d9decbe63ce941785b4202f1e6
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  c0009857-f794-4c39-9d30-caba04f270d0.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\c0009857-f794-4c39-9d30-caba04f270d0.tmp
                                                                                                                                                                  • Size 27KB
                                                                                                                                                                  • SHA256 1c2d3bd473e1870389f6737747a94d5e852790d686cf91b5e22ad83b190eefa3
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  df0e1d81-3f79-4db3-98aa-fbe63a408f99.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\df0e1d81-3f79-4db3-98aa-fbe63a408f99.tmp
                                                                                                                                                                  • Size 27KB
                                                                                                                                                                  • SHA256 3a9c655a88437e331f50a23bb40cb1a3de86277cb1a9488c81c426598cfab0a3
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Network Persistent State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
                                                                                                                                                                  • Size 61B
                                                                                                                                                                  • SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Network Persistent State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 d39a54ed005a5aa08479c451f8465d59fdc55a743040378d52ada659ce439b2e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  TransportSecurity
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\TransportSecurity
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 b8a4a06d0619e6b892816830d581073ed8cd0fe54810bff56178c40b2684a577
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
                                                                                                                                                                  • Size 11KB
                                                                                                                                                                  • SHA256 3f4d3c36e6ac4cb55bf672c975c2d83ee8a7c21576c7f8c9bf1b71e6b5f870ca
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
                                                                                                                                                                  • Size 16KB
                                                                                                                                                                  • SHA256 f82bd9264267ca3ca2dcee9faddbad0ca216ba45e42c68c379fcb1f4c3f71030
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
                                                                                                                                                                  • Size 15KB
                                                                                                                                                                  • SHA256 3f173cbb466ebd4d2f9319a14ea1d912feeb4803244ffad17841dd238ebe9339
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences
                                                                                                                                                                  • Size 15KB
                                                                                                                                                                  • SHA256 d5f0886c2c182152bcfe9ee85114be41cca6e153e6e24e4e8a58c0b5e4885881
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Preferenceseff9bafb-bc30-401f-ad6a-eafeaf21e750.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferenceseff9bafb-bc30-401f-ad6a-eafeaf21e750.tmp
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 50bc7c06198de19182d9a22cd64864dcef408b1c6cd7a5aabe5204fc24e04023
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Secure Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
                                                                                                                                                                  • Size 112KB
                                                                                                                                                                  • SHA256 68b4215d855da258add5929faa6e9e3d846a40be9719cd0b3614257342735042
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Secure Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
                                                                                                                                                                  • Size 86KB
                                                                                                                                                                  • SHA256 9e2f2be20567f594daacac9204ae54a20ff4e8783671becdefef7285f20419d9
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Secure Preferences
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences
                                                                                                                                                                  • Size 85KB
                                                                                                                                                                  • SHA256 6eee0169ce0f79e5e79e851aaa4a88d2892baf6c1a50ac3fd1bfd40d2f095e7d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  f3ab1e1292e135fa_0
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\f3ab1e1292e135fa_0
                                                                                                                                                                  • Size 47KB
                                                                                                                                                                  • SHA256 9b9953eed2e9ef54d872bf9401a70bcccc7f4dd898ae864812fe436968c4dc73
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  f3ab1e1292e135fa_1
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\f3ab1e1292e135fa_1
                                                                                                                                                                  • Size 112KB
                                                                                                                                                                  • SHA256 1b092e440ed55c16496e96fb5cd4222dfd528a45ca681fd48b0e68ef24a5ac6b
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  fb1f328d70d91607_0
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\fb1f328d70d91607_0
                                                                                                                                                                  • Size 87KB
                                                                                                                                                                  • SHA256 41747148da7ecaa407d40a13e7aac6592737235e411d34e2796de75bd239e87b
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index
                                                                                                                                                                  • Size 24B
                                                                                                                                                                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  4256d6f6-9bbf-460e-a019-9707a39df41f.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\4256d6f6-9bbf-460e-a019-9707a39df41f.tmp
                                                                                                                                                                  • Size 192B
                                                                                                                                                                  • SHA256 d675332317bb9c1e5d218afeb0e6491410633c598e973818ad14492abe64d76c
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  fe2856f5-37b9-4bbf-9fbe-a5d2a5035f8a.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\fe2856f5-37b9-4bbf-9fbe-a5d2a5035f8a.tmp
                                                                                                                                                                  • Size 72B
                                                                                                                                                                  • SHA256 7ac857aa4d72ccb8bd03cc60d8430c9b53619357b69e0f9085392c3d62d81bc6
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                  • Size 120B
                                                                                                                                                                  • SHA256 8316d154a65c358cd8db58edb6414035b0c745690d41bf42ca03a56548e73919
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                  • Size 216B
                                                                                                                                                                  • SHA256 a7a64097848241b5c00735118eba739823f096bb1a19407bc7f7a8d57a5c0694
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  the-real-index
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                  • Size 360B
                                                                                                                                                                  • SHA256 dd2e5922c9ee38897ecf5b4906e65997b6d7558d822aed71b3c64b33d7e8a9c2
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  1cb3f9be-81ab-4452-8f28-729005810f3f.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\1cb3f9be-81ab-4452-8f28-729005810f3f.tmp
                                                                                                                                                                  • Size 381B
                                                                                                                                                                  • SHA256 5e1ef8829f182d57b8dd9b6cd0f5b102c89a1b73731939636864f9d3f797f8a5
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  9da8802b-ee5b-40a4-857f-c2b0239bfb5e.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\9da8802b-ee5b-40a4-857f-c2b0239bfb5e.tmp
                                                                                                                                                                  • Size 381B
                                                                                                                                                                  • SHA256 2a3182b8be3f298c13adf18b060c32a9dd8d45ea1ec2dfdde1c4095f030eec82
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  b7dcdf56-2897-47ca-b46d-50d2dae4eb79.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\b7dcdf56-2897-47ca-b46d-50d2dae4eb79.tmp
                                                                                                                                                                  • Size 381B
                                                                                                                                                                  • SHA256 f3f1385a6339cbfd23e9359840cb56a728df6d1cf3fc54c0518e43fc209de6c6
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 11KB
                                                                                                                                                                  • SHA256 50afa0c00eede07050f587d9c2bde9b9e35910193836bad76d07132f6669ca2f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 11KB
                                                                                                                                                                  • SHA256 0743ee81e378adf57c9a79ac0e095db2ebae649205522158bcdf7835494042e7
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 60f2ad2f4e91cd80f888cb670881e6532c644133536465f442a1f22c0fd97c7f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 167dca553674e289831b02c027b81126fcf0398834c34ba16ab3d2267c8473e5
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 2e5b7c4f6bbd9e9f1e238a6bf0f29589d29644c5a87cecb4700d67e53e36e31b
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 11KB
                                                                                                                                                                  • SHA256 8efc306b04b372d891c77728d9ada535b27da74c70086aca10f233c25a7f3e69
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 493B
                                                                                                                                                                  • SHA256 ca6d25e300f5333743a0303a3965bd8bb76b46c438e11095b34b24d35ff5ae3b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 6KB
                                                                                                                                                                  • SHA256 7a021df85591756d2de61911462700b3a658a36170c1cb78f2195bbf386a8dec
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 412e5fdbcf3ad67bb795f8902186f4b31ab3362f14291cfe39c0e4da6f730f2f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 01daa56bef7ba598c8df50a88cb3ee0462cfdb745fa3f95421cf7b40dd8a8edc
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 13742cc10960e22e046feb99fd223e137f228b66a8c9b287fbdc50fbff70076b
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 7583c6dba51b0e960f5b14a169f4825ba82043036ead633c676b5d38e4eb7b6d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 ab7c4d8234563874522b79a5b02c003982f1ca062e50b0db22b0843838be42cb
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 e62c0a3824d39236dcedd9ddc9b1edd7011e6dd80a451b3ecd3356ce74d0e57f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 74e5c2c7a485d7c05b81abbaaea16e4d4ed2a195832c3d4b4fa50863b6086b4c
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 25cd81d9c9b3aa5c5e6740fb815835856cb7883356198dbf5f970f496b4505eb
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 8ce4443a370ee9be2eec46821f6e9ab1d9e8fd1c738036d60fac131dc0c1e4ec
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 6671ec29175297844e3ddfa8a040472e2c837c1aefbfb4e203b21decbed7e62a
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 90928e30f5bc38cc253f549d1e1aded8b1bc5a7a2e28a5fc0dd59c8668f46e2d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 3eb24ced94e1b5c7fdffd36675bcdc2b438163ba20d5d684c3765f8e3d0c1eb0
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 9ac60f951794065c38788278e5db8b63828dc88fcc0b84a41a71722004977632
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 7KB
                                                                                                                                                                  • SHA256 cca777cff79f9b70de5e9795a0b07ca534dafcb81a849d9010492298515e5e3d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 7KB
                                                                                                                                                                  • SHA256 be6c2c6573c59f90dfbfad146c90f3fa5ee5ca7e1c86fbd56788ff2c39de113f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 8a9843e65b724602e1a803aec1c42080a4fb8bd6f5aa020c6e482e9698b9ecda
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 46ea01072484f51928164461ad9b3850552e2e961ebc9939cc4e0bb05ccf3857
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 a201bad542d739c0a273d7ce16fe75c3b3b5b46c8dcc0e89ef181999df803ec7
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 1ce0f0cc06728583682b98a8690fd28bc6ac8ca97bfc753cc2fe1c32ed45827d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 090fa66f507b6c41b3ae8cc48836fe6642bb874a20128e49eb5be6aa0bcaa45e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 7KB
                                                                                                                                                                  • SHA256 94685778738b09b89647eb25981ed832b8bc4ff77e2df7c98a0165004ffb44c5
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 7KB
                                                                                                                                                                  • SHA256 c972b4ce4283c5fdeb6adf9b4dad701af22c09deaf1e1d9e7db0028befc95864
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 e8938514a29f4426623b00aab435a67c924b92bb452e732c37d939c97b60ae1d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 95c2ab0de2ab6a6ea582cc20d7c0e97644892c10d7d401ab08f9c449b6413302
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 621B
                                                                                                                                                                  • SHA256 8856f0e67bb4cc84d1a61cba1f21bbee1e59cb3019dc5f98cfa13460e46eda01
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 fa984818f9ab478d697f3ceaf9ea21a22d50fd6ab8049f45696456209c4ec8df
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 749B
                                                                                                                                                                  • SHA256 33c6a1fe2157b1fa30da35145fc1fe58ddac638623919f16baeb8a4b3f1f56b5
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 e7782f0a416683178e035cdba4dbba163c83e2a29917455d4d279319e9b922be
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 925B
                                                                                                                                                                  • SHA256 058ef0c4f1349aad69fe646b7d855a31d5cccd15450ba0fdab3c574ab4800bc3
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 cfb7415e76988f16084d568c0ae3b0ae63458303d33e67115e93398ec0a28bf8
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 7ef1bc0d487388d9d122dad9f5055ac29165d258a8c69cfbbe7ee870f009061b
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 6b31a3008606cba247f2236e53fbea7f2c719c94713fa7939c72a1a036bc7b34
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 a71b7833917f8084715c12a8244faa8d99fabd61b3e0e9ae6e3f0a0616f0b2c9
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 751fd3ffe5fbddf8b5e5e2d96da999ad28964e4a9af46a9442f59b56a8f53c6d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 ccc419af0b40f54a52df5dd532cf049f911d3e4674d8e6c9260a435478133f4d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 1933486b39f5659bd3c2e12dd84e65be8bfcd2be912457a57865c73be464bd2e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 181ec305d200a6c06a9af8928b715ea23416900f0a88544627660fc50d4e59db
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 0ac65264956c7526020aa7caa9052f116565cf9fce164fd902e97085a836b36a
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 7KB
                                                                                                                                                                  • SHA256 8d16790748ef5aca0c1b807ece694ee9bfe55266f3f3a6d0a133484f68e55126
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 f8d43ca9fa1accafe6bd1c7346286fe13d422757d7b3c9ca3e296c22523098ab
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 280cd9e63ffa35ee0dca749a3326d2a91389673419770c50de3f46aa2bd6c281
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 6KB
                                                                                                                                                                  • SHA256 2e8c3ffcd19f7aa07a72b4db9f58fa752a0b8384422080544259cd283f91b2f5
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 98790a5bbd0a0991403e29bd1fa3fd617e973c139d88fa8a7d80bfd96b09571e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 22fe7be42552e0d55fdfd7dbb6a70dab6658b4ad41c5a72870e01fd20461fa67
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 08dbec9ebf8133087e02b2a76e4fb95ed91efcba3583b0a09cce59171fc24cd3
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 7193b66eaf6ceed1fadfa2876e0ec6e60c33ee5baa46753ee641a865192ff9a7
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 c90bf34f7e763ed5aee2b4039d9f9d10acf9dd9bd01357d37f642fcbf9a6303a
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 1a50f10d12b2765de3b82c30fd86a74a9158f2917708bf66d229e57010938c2a
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 973B
                                                                                                                                                                  • SHA256 e0fcf853559f47dada9de4836a7612f9dc3927617dc4cee36c43bbab2ebd874e
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 fcb89130b568a6bf31acfed201f32ec21801e0711214deeb568fae708348f4cd
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 9KB
                                                                                                                                                                  • SHA256 d22da5b1ec8d50b662eb926f735476a568e9f2cada5ad1e81fe0eb604b6e85a8
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 e078854583506e9c965044d8bd4fe52735e3a8109e2c6699edeb8a239a8ebd86
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_836739e9-65ca-4efe-9a6d-a7a2f85455e6.raw
                                                                                                                                                                  • Size 10KB
                                                                                                                                                                  • SHA256 6b2ad7beb13ea59998096ea8207c4d15242e2e16d6af871d5dcdbdd81639c7a8
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 a2db405b176638371f6c649606551201546dadca2cca0b83c724adaaaef62f76
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 99dcb4b63c8c686f3f1041155171af5df64f1181493e416267000ebb20074e56
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 d16829a64f0a1aa2a0fb108ddf864aca0332b9e09e1aefbc85c3d47230ad3e98
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 493B
                                                                                                                                                                  • SHA256 7c973d58616fd7ca569d4735840a977aba2105ea911c88678d004d489c48f44f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 781B
                                                                                                                                                                  • SHA256 fa95fd4a03f3cc0dbecc7fbaeae9f3f82ce6b9964d9a0c9db1210a1ba521c0f8
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 797B
                                                                                                                                                                  • SHA256 7a129dadffc1c3b0cb620cf2201c25e3e0ab9e7f9e3d1a87a0f7bc27732772f9
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 797B
                                                                                                                                                                  • SHA256 0491b3bb932b57de81905dfdb489c4d2e62fbfd911ede61523532ba3fcab6eef
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 8397669443e5aa4f74ce1b668ab3b1a6525542a66a86d3cc02681bcaa5398600
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 0e66d83b6ed3da379182a8824d63535aa1d6d65b2a8373535f4b65a25ac52ee0
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 621B
                                                                                                                                                                  • SHA256 e8af4b58ef61e5ba7970f37050fca6256bd2362a26929275d80fa25da5474883
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b7e67520-2ada-4b52-86d2-268d3b1e88c3.raw
                                                                                                                                                                  • Size 973B
                                                                                                                                                                  • SHA256 b890dacd89c47aed0c47f83799413df48f23210020813d4f61b5d8ad2686256f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Size 493B
                                                                                                                                                                  • SHA256 563958bda16a7f1e7816515bba9c14d81d8913aa511c423d79f08694c21d09d0
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Size 621B
                                                                                                                                                                  • SHA256 192bd4bfb0f2578b91aecfc016f796e781de0016be9faeadea3cc8ad20149e56
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Size 637B
                                                                                                                                                                  • SHA256 4388d48f3e1cabf9797313ebc5b5328b3856942bb148f55a41688ae1267b10ed
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Size 637B
                                                                                                                                                                  • SHA256 0ad97de6f97b3c6b8a925f8135c906c25b1c6b5235db3e21f6dc74af9e7e2fc4
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Size 653B
                                                                                                                                                                  • SHA256 3fb197e41224709dce88273222a29a00a47ee8b3044f6f0d36e357d77acb5cf0
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Size 845B
                                                                                                                                                                  • SHA256 a9fdc524269166031657626344512966d61f318b8acdffaa9ad6853f17ebc0f5
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_cb5f1b2e-b3ae-46ae-8378-82d736d02f1e.raw
                                                                                                                                                                  • Size 813B
                                                                                                                                                                  • SHA256 95a328296d28964ef192ba79355f7d374342eb02dfd745f2220446084851dc87
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  MANIFEST-000001
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Sync Data\LevelDB\MANIFEST-000001
                                                                                                                                                                  • Size 41B
                                                                                                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  bd27d2cc-3395-42d7-9e29-711185022f73.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\bd27d2cc-3395-42d7-9e29-711185022f73.tmp
                                                                                                                                                                  • Size 456B
                                                                                                                                                                  • SHA256 9d5a8d9208702c16e2a5a1b4e5e797ad7e779bd195cae90442d6af3ace0d73e3
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  bf245a28-a2fe-49d3-89d9-95c9a5cb35e6.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\bf245a28-a2fe-49d3-89d9-95c9a5cb35e6.tmp
                                                                                                                                                                  • Size 203B
                                                                                                                                                                  • SHA256 a113f0adc16134c8c7005ced80a97c0e862026b0cf3ee9e391cf05c8183c999b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  e91ccd12-e2b6-47a6-9e75-0547aa23b99a.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\e91ccd12-e2b6-47a6-9e75-0547aa23b99a.tmp
                                                                                                                                                                  • Size 171B
                                                                                                                                                                  • SHA256 b0fba5e2e61ddcca14fc0d0146a06eb97abc303fe180981e5852f2bc5b016ba6
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp3656.0.2020823504
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp3656.0.2020823504
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 894475f2e614f150d330b884aefa08930fa1a643d97efbfa7b0a8889cbdbbdd5
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp3656.0.2020823504
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp3656.0.2020823504
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 89fc65ad8a1fdac35059f313f8924275b9663c385babe94abd2ff8bddb4ae3c5
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp3656.0.2020823504
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp3656.0.2020823504
                                                                                                                                                                  • Size 265B
                                                                                                                                                                  • SHA256 199b3ac224cd534974ee3a1ba4acd3f3b712979de39f4664442dbbe71156a37d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 823B
                                                                                                                                                                  • SHA256 472203471a7e6be17092a6a74a8feceb29e01bab1a713c9ded6d0ff67e9bd022
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 917B
                                                                                                                                                                  • SHA256 7486ad150d03c0d23ab6088beef93aceba5c9c40b18f13e04b95bbf498983e3f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1013B
                                                                                                                                                                  • SHA256 d0cb7fbc02473f215dcbe8adfdd769c73728da636c2b6e6387dd1fba73a60292
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 9b7fb36359baa9855c34680a32b2bb2c58a3cd7aa8e127fe35d60516cd5015c2
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 fb3d475d1978a0b8407bf880f157ffae20a0547c5521e335325e0d077bfb0802
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 83e5def4345b7e5044c22b8f1a3ec2c4a7bd889c37aab8824a36212cea6014af
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 647B
                                                                                                                                                                  • SHA256 e5c97c9f78aa76f9550460f9ecf93e387c6e61021ef3fc85e7ed29176aac433f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 8fa0455664e87ff3934fc8b93633762b33066187b4beef51b37e8fdd616a25f7
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 737B
                                                                                                                                                                  • SHA256 2465f05979a4137cd6c0362cd1601041b6e6516d874232f64a9f1c14664aeecd
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 9895321fa6373545e2667d4b2c3e7e535aec961be848c4c4aebaa05b49464b36
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 2e50b52d4f29333313745296eda0106a9247bb5624f7d6c4ec772c516ad24d6b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 bfcd9c0aa89dd551f9212db90fd536da270fe03a865bb3ecd270f7a05f081cd9
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 c4ec853a08ae87b86dbb20b2c8e4365f647a3e0973e0dd822581025f0e4a8ab0
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 bdeebb4ccd73a51a9c583c90ea2a267473323341f1f16061b8bb48280e416629
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 808dfccce01df9deb41d7f373bcb5fcd43b33980a534016d344965900034e5f4
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 385d2da460b0912d8bb90d77d366d855b0f117d3b4c30a669c60655bbfc56839
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 06496250631bc0293d5504b1b953ca77b87c5da3db489844c753aea67d81d8d7
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 a247647d640e42b36c666cabb064871251acb3c3895763be84e660939d85d89c
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 8e3b791aef737d3e08d5d5ef6d982c16d97e1ee790ef3af969b6b7dad3d948dc
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 27e79ef9c20fc79c5b8dceec09c4f4ad6068a6adf0c23f875b50dc2ad7039b61
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 549B
                                                                                                                                                                  • SHA256 32b3f8309470a80459c398b1a0225019b1f16943820682e0652eb39d564f8e38
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.0.1016436934
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.0.1016436934
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 4ab36545ad40edd6b49f4af1ece8574161fc0f623df364b8fb2850b60126fdac
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.1.662457989
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.1.662457989
                                                                                                                                                                  • Size 306B
                                                                                                                                                                  • SHA256 07f84a966deda354a2e5762db7e02e2be11b970868757918ff5bcec71d392591
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.1.662457989
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.1.662457989
                                                                                                                                                                  • Size 404B
                                                                                                                                                                  • SHA256 610f3a7c77b03e0a4fcd039d2132f13d8e6d6b50bfc46d5f751ce0daaede3209
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.1.662457989
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.1.662457989
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 b106d383f0edc13454e361e8f9cf01d5408d5d4d59e0871d5ac22f5fdb10df2c
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.1.662457989
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.1.662457989
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 44de1161daebb6bc5019211358d582e3a92c218d9a56ab4a3aa6a747e203b40d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.1.662457989
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.1.662457989
                                                                                                                                                                  • Size 200B
                                                                                                                                                                  • SHA256 7805edf84902f424d8a59840e0533e0c66b0bc980d1cf2be40bf556c2bf3be1f
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.1.662457989
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.1.662457989
                                                                                                                                                                  • Size 466B
                                                                                                                                                                  • SHA256 36f7d4727dd9c2c933a28c8eca6bfceb0d6235bfbb6ce395d6cc9f383c28b638
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp6256.1.662457989
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6256.1.662457989
                                                                                                                                                                  • Size 306B
                                                                                                                                                                  • SHA256 2d804fefc01f15afda7af9df8e4721703d7198d22f7e0bfcc4124a9b08e47f17
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp7172.0.1040868867
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp7172.0.1040868867
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 4d492d1f7fbd1ec2da6ff42a83b91e67229bc04da7ac1fb5d303943764d16b73
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp7172.0.1040868867
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp7172.0.1040868867
                                                                                                                                                                  • Size 1KB
                                                                                                                                                                  • SHA256 0c36a9b5ddea87c208903728690515bfe4301048cb1b7b80bc1e1d18f100362b
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  ssdfp7172.0.1040868867
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp7172.0.1040868867
                                                                                                                                                                  • Size 265B
                                                                                                                                                                  • SHA256 54ba7f85f2c6b6cf1334e9f6643cb14f9c65df039e9c9aa7ebf8200dfb92c9d0
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  suggestions_cache.jsoned41514e-758f-4775-a45d-8d6f4ed6ec07.tmp
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\suggestions_cache.jsoned41514e-758f-4775-a45d-8d6f4ed6ec07.tmp
                                                                                                                                                                  • Size 652KB
                                                                                                                                                                  • SHA256 92de49733d76cc032d8b4705b52558b55b850a266fdbc1289d2a4f4179d6ba3e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  data_0
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\GrShaderCache\data_0
                                                                                                                                                                  • Size 8KB
                                                                                                                                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                  Submit Download

                                                                                                                                                                  data_1
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\GrShaderCache\data_1
                                                                                                                                                                  • Size 264KB
                                                                                                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State
                                                                                                                                                                  • Size 3KB
                                                                                                                                                                  • SHA256 d2d73edcbf347080f6edd3bc5a1f332d72a2ec3bbe2a1f5cb7255c06681a9c95
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State
                                                                                                                                                                  • Size 5KB
                                                                                                                                                                  • SHA256 45ec8a1794dceb681ca1bdfd9ad8e874d3fb9c257757c2f74c3417b2b5d9866f
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State
                                                                                                                                                                  • Size 2KB
                                                                                                                                                                  • SHA256 5f908d0098d5437e68dee7fea02de3bde756af00bd2b83b3f8a040c7014e914d
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State
                                                                                                                                                                  • Size 4KB
                                                                                                                                                                  • SHA256 dc6924d4dfe57dad8bcc88b4a137100087fd3c1ab9ed539c475e88bd2187b429
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  Local State
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State
                                                                                                                                                                  • Size 5KB
                                                                                                                                                                  • SHA256 5e5e57dd712afaa96df5530ffbedf4628e9278ff53d98bfe07e8821ea7156f0d
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  VariationsSeedV2
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSeedV2
                                                                                                                                                                  • Size 11B
                                                                                                                                                                  • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  VariationsSeedV2
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSeedV2
                                                                                                                                                                  • Size 19B
                                                                                                                                                                  • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                  Submit Download

                                                                                                                                                                  assistant_prefs.json
                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\assistant_prefs.json
                                                                                                                                                                  • Size 150B
                                                                                                                                                                  • SHA256 ef31329df4672264637ea3b9c4b2fe2c324c2189c79f7579f57735545a292fad
                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  OperaInstaller.exe
                                                                                                                                                                  • Path C:\Users\Admin\Downloads\OperaInstaller.exe
                                                                                                                                                                  • Size 178KB
                                                                                                                                                                  • SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                  Submit Download

                                                                                                                                                                  memory/684-3273-0x0000017017970000-0x0000017017971000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4368-3499-0x0000025497640000-0x0000025497641000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/4368-3579-0x0000025497490000-0x0000025497631000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6228-3130-0x0000017829010000-0x0000017829011000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6384-1845-0x000002231F760000-0x000002231F901000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6384-1010-0x00007FFD308F0000-0x00007FFD308F1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6384-1011-0x000002231F910000-0x000002231F911000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6388-2008-0x0000021F0DDB0000-0x0000021F0DDB1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6388-2650-0x0000021F0DC00000-0x0000021F0DDA1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6396-2651-0x0000019AEC050000-0x0000019AEC1F1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6396-1937-0x0000019AEC200000-0x0000019AEC201000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6556-3576-0x0000022E704D0000-0x0000022E70671000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6556-3129-0x0000022E70680000-0x0000022E70681000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6660-3575-0x000002080B920000-0x000002080BAC1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6660-3126-0x000002080BAD0000-0x000002080BAD1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6880-1067-0x0000021F288F0000-0x0000021F288F1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6880-1792-0x0000021F28740000-0x0000021F288E1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6888-1790-0x0000023788AE0000-0x0000023788C81000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6888-1175-0x0000023788C90000-0x0000023788C91000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6924-1791-0x0000015D7C680000-0x0000015D7C821000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/6924-1542-0x0000015D7C830000-0x0000015D7C831000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7384-1864-0x000002E1369F0000-0x000002E1369F1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7384-2668-0x000002E136840000-0x000002E1369E1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7420-3134-0x0000028D8C400000-0x0000028D8C401000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7440-3132-0x0000015C80B30000-0x0000015C80B31000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7532-2701-0x000001A9594A0000-0x000001A9594A1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7532-3555-0x000001A9592F0000-0x000001A959491000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7580-2692-0x0000025DE1320000-0x0000025DE1321000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7604-2697-0x000002AA5CDD0000-0x000002AA5CDD1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7628-3580-0x000002B765240000-0x000002B7653E1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7628-2700-0x000002B7653F0000-0x000002B7653F1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7708-2652-0x000001487D5F0000-0x000001487D791000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7708-1906-0x000001487D7A0000-0x000001487D7A1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7724-2705-0x00000257D7F50000-0x00000257D7F51000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7764-2695-0x000001CAE98B0000-0x000001CAE98B1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7768-3578-0x000001BA9FD50000-0x000001BA9FEF1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7768-2703-0x000001BA9FF00000-0x000001BA9FF01000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7836-3577-0x000001CB1B120000-0x000001CB1B2C1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/7836-2707-0x000001CB1B2D0000-0x000001CB1B2D1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8228-3572-0x000001A8933C0000-0x000001A8933C1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8264-3275-0x000001E35DD20000-0x000001E35DD21000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8272-3303-0x0000019FDC420000-0x0000019FDC421000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8272-3584-0x0000019FDC270000-0x0000019FDC411000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8540-3574-0x000001F8D6290000-0x000001F8D6291000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8556-3583-0x0000016222860000-0x0000016222A01000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8556-3305-0x0000016222A10000-0x0000016222A11000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8564-3289-0x0000014F71660000-0x0000014F71661000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8572-3301-0x000001BD2ED30000-0x000001BD2ED31000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8572-3585-0x000001BD2EB80000-0x000001BD2ED21000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8580-3581-0x000002BC492A0000-0x000002BC49441000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8580-3309-0x000002BC49450000-0x000002BC49451000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8588-3291-0x0000026C7C760000-0x0000026C7C761000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8596-3293-0x000001DD75DF0000-0x000001DD75DF1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8596-3589-0x000001DD75C40000-0x000001DD75DE1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8604-3295-0x000001D3A98F0000-0x000001D3A98F1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8604-3588-0x000001D3A9740000-0x000001D3A98E1000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8612-3586-0x000001F565FA0000-0x000001F566141000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8612-3299-0x000001F566150000-0x000001F566151000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8620-3297-0x0000025F26140000-0x0000025F26141000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8620-3587-0x0000025F25F90000-0x0000025F26131000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8648-3582-0x000001B7E47B0000-0x000001B7E4951000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8648-3308-0x000001B7E4960000-0x000001B7E4961000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8656-3550-0x000002B9B7640000-0x000002B9B7641000-memory.dmp
                                                                                                                                                                  Download

                                                                                                                                                                  memory/8860-3569-0x0000022CF9000000-0x0000022CF9001000-memory.dmp
                                                                                                                                                                  Download