Overview

overview

8

Static

static

8

OperaInstaller.exe

windows10-2004-x64

8

OperaInstaller.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 06:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OperaInstaller.exe
  • Size 178KB
  • Sample261011-hbd9maxshv
  • SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Local\Temp\OpInst.exe
      "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=NGQ1MzE2ZTRjNjQzMzVmYmJjMDhkMjY3ZDhiYmQxNmQ2ZGU1YzQ0ODMzNDdmZGIwNDJmOTQxYzEzNzFmYmVlYzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJ0aW1lc3RhbXAiOiIxNzkxNzAwNDE3LjM0NjgiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoidmlkZW8tc3RyZWFtaW5nIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJ3cmsifSwidXVpZCI6IjdhMzI1YmY4LWE1YTctNDY5NS05NTAwLWE4ODkyYmM4MGMwZSJ9
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Enumerates connected drives
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:1300
        • C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x2b4,0x2b8,0x2bc,0x294,0x2c0,0x7ff7319f09d8,0x7ff7319f09e8,0x7ff7319f09f8
          4⤵
          • Executes dropped EXE
          PID:1932
        • C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\installer.exe" --version
          4⤵
          • Executes dropped EXE
          PID:3716
        • C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1300 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_20261011073337" --session-guid=367cbce8-7c61-4833-9961-bda13f9d869f --server-tracking-blob="OTE0NTY4ZmUzMWRhNzAzMmI0NWVmYzMzYmVjZWFhOGIwMTllMTQyNDQ2ZDdkYmEwZTEzNTY3YWQzYTA1ZDVmYTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTE3MDA0MTcuMzQ2OCIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJ2aWRlby1zdHJlYW1pbmciLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiN2EzMjViZjgtYTVhNy00Njk1LTk1MDAtYTg4OTJiYzgwYzBlIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=4408000000000000
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:248
          • C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x2ac,0x2b0,0x2c0,0x288,0x2c4,0x7ff7319f09d8,0x7ff7319f09e8,0x7ff7319f09f8
            5⤵
            • Executes dropped EXE
            PID:4120
          • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe" --backend --initial-pid=1300 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371" --session-guid=367cbce8-7c61-4833-9961-bda13f9d869f --server-tracking-blob="OTE0NTY4ZmUzMWRhNzAzMmI0NWVmYzMzYmVjZWFhOGIwMTllMTQyNDQ2ZDdkYmEwZTEzNTY3YWQzYTA1ZDVmYTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTE3MDA0MTcuMzQ2OCIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJ2aWRlby1zdHJlYW1pbmciLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiN2EzMjViZjgtYTVhNy00Njk1LTk1MDAtYTg4OTJiYzgwYzBlIn0= " --silent --desktopshortcut=1 --install-subfolder=137.0.6036.39
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3584
            • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x288,0x2b8,0x2bc,0x2b4,0x2c0,0x7ff64ed309d8,0x7ff64ed309e8,0x7ff64ed309f8
              6⤵
              • Executes dropped EXE
              PID:4872
            • C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes a Windows system DLL name to a user directory
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Suspicious use of WriteProcessMemory
              PID:5832
              • C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x88c9cc,0x88c9d8,0x88c9e4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:5044
              • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4268
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xa8c9cc,0xa8c9d8,0xa8c9e4
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5016
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:792
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:4772
                    • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                      10⤵
                      • Executes dropped EXE
                      PID:4164
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:2916
                    • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x278,0x27c,0x280,0x274,0x288,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                      10⤵
                      • Executes dropped EXE
                      PID:2356
                  • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2a0,0x2cc,0x1007324,0x1007330,0x100733c
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5784
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:4528
                      • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                        11⤵
                        • Executes dropped EXE
                        PID:3424
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:824
                      • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                        11⤵
                        • Executes dropped EXE
                        PID:3300
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:1340
                      • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                        11⤵
                        • Executes dropped EXE
                        PID:4420
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\de932af914ba00303d4a2778a383ac9c831101e2.crx"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4076
              • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                7⤵
                • Executes dropped EXE
                PID:5392
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1912,i,853873131808588502,12866030648171017873,524288 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2152 /prefetch:11
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                PID:600
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1684,i,2422206947373489784,6083055097374922943,262144 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2116 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5340
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2548,i,7868513519227364054,4642897854855918205,524288 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2744 /prefetch:13
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5244
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3568,i,7879772926958511077,5275939405872940837,1572864 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3612 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6376
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3968,i,5747944562623318264,7519560944034800562,524288 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4008 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6616
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4516,i,11056273759168224737,7258439026734063639,1572864 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4568 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6716
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4740,i,17255021592963620255,5622206671900180692,524288 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4752 /prefetch:12
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:7104
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4908,i,13043117343057879673,2413948699760750081,524288 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3664 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6204
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4928,i,11677044542728823326,9268502789981796060,524288 --field-trial-handle=2120,i,1336323357724747144,692183555738409117,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2124,i,12429334887083092488,17639783326138791357,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5200 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:7040
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:6892
              • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                7⤵
                • Executes dropped EXE
                PID:6692
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1740,i,13995144255749962041,4914103024617491963,262144 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2032 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:7148
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1972,i,11792544896621097126,11288557456493030522,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2064 /prefetch:11
                7⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                • Enumerates system info in registry
                PID:6660
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2500,i,935082776097770978,4042370126555203190,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2596 /prefetch:13
                7⤵
                • Executes dropped EXE
                PID:6280
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2740,i,101058804341999368,627048896780247384,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3336 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:6712
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3228,i,15918136872044036932,15487820961678326228,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3360 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:6480
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3240,i,7620362223224431190,10794769354153446006,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3380 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6040
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3256,i,8058251459326950954,1876664517948487353,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3400 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:1152
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3268,i,6713280074354615892,4010828280907468868,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3420 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6400
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3280,i,15665470057746541087,2901934032407357285,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3440 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:6868
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3292,i,8890990620721920032,7296593338637637960,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3460 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:6912
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3632,i,4267250190894416095,8174053398454104734,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3732 /prefetch:1
                7⤵
                • Enumerates system info in registry
                PID:7044
              • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_gx_splash.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C96
                7⤵
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:1768
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3600,i,7544249873714555609,17991025189250067712,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4788 /prefetch:9
                7⤵
                  PID:5328
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4956,i,918262088083653662,649889658142585960,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4972 /prefetch:1
                  7⤵
                  • Enumerates system info in registry
                  PID:6716
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5236,i,10761274728671156237,1062035941526436658,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5252 /prefetch:1
                  7⤵
                  • Enumerates system info in registry
                  PID:5008
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5400,i,13604641572957070037,11312057840015632335,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5408 /prefetch:1
                  7⤵
                  • Enumerates system info in registry
                  PID:5468
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=1872,i,3548826709510156499,5909839175645823502,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5128 /prefetch:9
                  7⤵
                  • Enumerates system info in registry
                  PID:5768
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6932,i,4766591389692784317,12117750392683211205,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6820 /prefetch:9
                  7⤵
                    PID:4720
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6944,i,10817016583775522523,13954971813271217645,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6960 /prefetch:12
                    7⤵
                    • Enumerates system info in registry
                    PID:7568
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7092,i,12289161709518061633,5162228199904807702,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6636 /prefetch:14
                    7⤵
                    • Enumerates system info in registry
                    PID:7584
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6940,i,14359399128995269956,13681609281601846603,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6968 /prefetch:14
                    7⤵
                    • Enumerates system info in registry
                    PID:7580
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6912,i,9973005465067831084,3751677898097808640,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7400 /prefetch:14
                    7⤵
                      PID:7612
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7160,i,12347668050418808374,9337741443362911997,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7424 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:7620
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6324,i,6394010045127765540,1159267310884712594,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7444 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:7628
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7368,i,10748577317999097955,2791547896312300276,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7480 /prefetch:14
                      7⤵
                        PID:7636
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7404,i,7161670238259276048,15969897943496977236,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7928 /prefetch:14
                        7⤵
                          PID:7660
                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8064,i,5908621147363770075,14983076477509339808,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8076 /prefetch:14
                          7⤵
                            PID:7672
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8084,i,3729135855707803969,8539462285485974258,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8216 /prefetch:14
                            7⤵
                            • Enumerates system info in registry
                            PID:7684
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8348,i,4617050698580768968,13746739544039714790,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8360 /prefetch:14
                            7⤵
                              PID:7696
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8492,i,15239258740613564426,5889452820094863315,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8504 /prefetch:14
                              7⤵
                              • Enumerates system info in registry
                              PID:7708
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8632,i,549191967230751097,5568802352689246554,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8644 /prefetch:14
                              7⤵
                                PID:7720
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8652,i,2562012852643786834,2284291255230693014,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8780 /prefetch:14
                                7⤵
                                  PID:7732
                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8464,i,7643905084867286927,14186813440438536055,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8940 /prefetch:14
                                  7⤵
                                  • Enumerates system info in registry
                                  PID:7744
                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9072,i,16408365576382870996,2471885539743491622,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9084 /prefetch:14
                                  7⤵
                                    PID:7756
                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9232,i,8227989057653417482,4376446697214347120,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9240 /prefetch:14
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:7792
                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9380,i,14908775468928226064,1074973432668819469,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9416 /prefetch:9
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:7804
                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9556,i,15082273862960959607,7019785485529210577,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9612 /prefetch:1
                                    7⤵
                                      PID:8084
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9584,i,2530841756734015185,15338421846534716405,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9568 /prefetch:14
                                      7⤵
                                        PID:8904
                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9404,i,14566808963913743114,7606389107360879957,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9392 /prefetch:14
                                        7⤵
                                          PID:8920
                                        • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
                                          7⤵
                                          • Reads the TCP/IP host and domain name from the registry
                                          PID:9176
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                            C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x29c,0x2a0,0x2a4,0x274,0x2a8,0x7ff755678598,0x7ff7556785a8,0x7ff7556785b8
                                            8⤵
                                              PID:7272
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3488,i,6888222926214817765,5632128449535700930,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10500 /prefetch:14
                                            7⤵
                                              PID:9204
                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=1868,i,4476570150402630199,8986127936607392169,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10600 /prefetch:1
                                              7⤵
                                              • Enumerates system info in registry
                                              PID:244
                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10936,i,5664910887561406248,16867462304893549214,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10944 /prefetch:14
                                              7⤵
                                                PID:7680
                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11076,i,15361873562588442495,9944504524867956886,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11084 /prefetch:14
                                                7⤵
                                                • Enumerates system info in registry
                                                PID:7300
                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11220,i,991440854539203503,12222287842622304792,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11092 /prefetch:14
                                                7⤵
                                                • Enumerates system info in registry
                                                PID:7532
                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7896,i,7945361067022689550,3946622282807426618,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=8612 /prefetch:14
                                                7⤵
                                                • Enumerates system info in registry
                                                PID:8300
                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9852,i,1632280264019908951,1125672463486218792,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=7912 /prefetch:14
                                                7⤵
                                                  PID:8384
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4032,i,4317530362529779284,4225264173350837715,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=4060 /prefetch:14
                                                  7⤵
                                                  • Enumerates system info in registry
                                                  PID:8488
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7908,i,4584127157720319202,14852546589088642596,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=3696 /prefetch:14
                                                  7⤵
                                                  • Enumerates system info in registry
                                                  PID:8496
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3588,i,5256485767705597751,1892444419935800512,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=3576 /prefetch:14
                                                  7⤵
                                                  • Enumerates system info in registry
                                                  PID:8624
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5668,i,1749545193033097912,10133571812054845151,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=3540 /prefetch:14
                                                  7⤵
                                                    PID:8640
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8236,i,14117667546035040310,11550131400620145240,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=8328 /prefetch:14
                                                    7⤵
                                                      PID:8768
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9744,i,12987780157718330769,1017431384157087558,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=8096 /prefetch:14
                                                      7⤵
                                                        PID:8784
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8772,i,3962401823045574009,11605536103703107214,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=8180 /prefetch:14
                                                        7⤵
                                                          PID:9020
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8088,i,4862876649627629136,16034817204132876117,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=11088 /prefetch:14
                                                          7⤵
                                                            PID:6212
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=3948,i,8900653516408415124,12753910699554405592,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=11140 /prefetch:9
                                                            7⤵
                                                            • Enumerates system info in registry
                                                            PID:7012
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3840,i,9868090060227344132,14876987576045473264,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=10912 /prefetch:14
                                                            7⤵
                                                            • Enumerates system info in registry
                                                            PID:7960
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11080,i,8832117765505525090,15990701419023407556,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=3436 /prefetch:14
                                                            7⤵
                                                            • Enumerates system info in registry
                                                            PID:8280
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11668,i,11287869538095101695,8431641573483032008,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=2740 /prefetch:14
                                                            7⤵
                                                            • Enumerates system info in registry
                                                            PID:2840
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7776,i,18218876260384310704,9389624673603107480,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=7756 /prefetch:9
                                                            7⤵
                                                            • Enumerates system info in registry
                                                            PID:8392
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7816,i,5602819525294779941,8774852288497852337,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=7880 /prefetch:9
                                                            7⤵
                                                            • Enumerates system info in registry
                                                            PID:8608
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7756,i,11968591903547145585,8544307188184378983,1572864 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=7752 /prefetch:9
                                                            7⤵
                                                            • Enumerates system info in registry
                                                            PID:7928
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11832,i,8965172089869228918,11875491964137711593,524288 --field-trial-handle=2036,i,4667482226752631519,15500480404491910958,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2040,i,3781678441058965662,14111913440108917388,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=6964 /prefetch:14
                                                            7⤵
                                                              PID:2416
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Writes a Windows system DLL name to a user directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3712
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe" --version
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Enumerates system info in registry
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4828
                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x88c9cc,0x88c9d8,0x88c9e4
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2848
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Reads the TCP/IP host and domain name from the registry
                                                  • System Location Discovery: System Language Discovery
                                                  • Enumerates system info in registry
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2676
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Enumerates system info in registry
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3712
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                                                      C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:1620
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Enumerates system info in registry
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4392
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                                                      C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x278,0x27c,0x280,0xb0,0x284,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:5412
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                                                    C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x2bc,0x2c0,0x2c4,0x29c,0x2c8,0x1007324,0x1007330,0x100733c
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4480
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1452
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                                                        C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x274,0x27c,0x280,0x278,0x284,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:5284
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5560
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                                                        C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:5476
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Enumerates system info in registry
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1072
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                                                        C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x270,0x274,0x27c,0x278,0x280,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:2920
                                                • C:\Windows\system32\wbem\unsecapp.exe
                                                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                  1⤵
                                                    PID:2112
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6324
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe
                                                      C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffda5fe1e28,0x7ffda5fe1e38,0x7ffda5fe1e48
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:6668
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC1
                                                    1⤵
                                                    • Reads the TCP/IP host and domain name from the registry
                                                    PID:9168
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                      C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x294,0x298,0x29c,0x22c,0x2a0,0x7ff755678598,0x7ff7556785a8,0x7ff7556785b8
                                                      2⤵
                                                        PID:8876
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                                        2⤵
                                                          PID:6184

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            DLL Search Order Hijacking

                                                            1
                                                            T1574.001

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            DLL Search Order Hijacking

                                                            1
                                                            T1574.001

                                                            Defense Evasion

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            DLL Search Order Hijacking

                                                            1
                                                            T1574.001

                                                            Masquerading

                                                            1
                                                            T1036

                                                            Match Legitimate Name or Location

                                                            1
                                                            T1036.005

                                                            Modify Registry

                                                            2
                                                            T1112

                                                            Credential Access

                                                            Credentials from Password Stores

                                                            1
                                                            T1555

                                                            Credentials from Web Browsers

                                                            1
                                                            T1555.003

                                                            Unsecured Credentials

                                                            1
                                                            T1552

                                                            Credentials In Files

                                                            1
                                                            T1552.001

                                                            Discovery

                                                            Peripheral Device Discovery

                                                            1
                                                            T1120

                                                            Query Registry

                                                            5
                                                            T1012

                                                            System Information Discovery

                                                            4
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Network Configuration Discovery

                                                            1
                                                            T1016

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Data from Local System

                                                            1
                                                            T1005

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Size 471B
                                                            • SHA256 913396169ea76db7728052815d991a18ab2a53880bdf88652e33fc5aa9af2735
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Size 416B
                                                            • SHA256 9d0aecbb811ec1ef78d4dfc2a4521ec10804c7cf937b73ec2580bfd7b68af1ec
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            snapshot-new.baf
                                                            • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\Cache\No_Vary_Search\snapshot-new.baf
                                                            • Size 20B
                                                            • SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            f_000001
                                                            • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\f_000001
                                                            • Size 163KB
                                                            • SHA256 0e3fc25087b758604b1edf462ed674e702f8b761e872ac54911717ac699f991d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            137.0.6036.39.manifest
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\137.0.6036.39.manifest
                                                            • Size 225B
                                                            • SHA256 a63ae0542021b560b1bd4569d8ad5b20cba067e9ea88db7f1e729fd1423bf530
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-100.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-100.png
                                                            • Size 1KB
                                                            • SHA256 56bcd46dcfae3147a8b8b3d00ee5041dad4655e83a7e829bf637377c96538643
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-100_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-100_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 3829dbefe8bd528be268f3181a902e1fe78883eb8f8aac679c9985c2ad13c6b9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-140.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-140.png
                                                            • Size 1KB
                                                            • SHA256 2637072751e1e6398c45d2c5b22c54adadfbbd4d3007238799f5da63f846167b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-140_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-140_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 ce3559b2efd6d547fb822440690cfbf793eb70c98154ad4dbf3a7c0e1af5e166
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-180.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-180.png
                                                            • Size 1KB
                                                            • SHA256 7ca510381079a4b166e9d5fcf0dc005d9606197e8636621b655d6459941139a0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-180_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-180_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 f7eb888cd9bce4641fcb01088b05be242f616dc06c3f823e51fb63b53b6f14f5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-80.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-80.png
                                                            • Size 827B
                                                            • SHA256 f287370ff8c7e2ba120407cafe09c1fce674ae8af5bd5fcc0c2dd1c6628b9ce9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-80_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\150x150Logo.scale-80_contrast-white.png
                                                            • Size 799B
                                                            • SHA256 0a9129bde051c17e96e516d5bc509e1a06a1e066a5e2796627cbef8630002b47
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-100.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-100.png
                                                            • Size 781B
                                                            • SHA256 fb5662c5fde7d49862da2e0253ae03dc7e5f9afd2edc65d4efa6dc3a3026156f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-100_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-100_contrast-white.png
                                                            • Size 752B
                                                            • SHA256 3fa9dfc982544f3ffda0795beec69c65d6c5883be0de37133466e643b5f3aeea
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-140.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-140.png
                                                            • Size 991B
                                                            • SHA256 84f8ebb629791e0b73cd53d7f3445d685145d0787a207e25842b237c98a8c99a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-140_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-140_contrast-white.png
                                                            • Size 865B
                                                            • SHA256 99cd2b5809ab9c604613b305bc80e6f68b858c1289c07e84aadabc4c3768ff32
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-180.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-180.png
                                                            • Size 1KB
                                                            • SHA256 c5d33ee3b5e8dcb9e9aeae5f14d0e92cf9bdc16d6245ce65dd4340c8a0be4f26
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-180_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-180_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 e5112331e0e2684ffb5adc0ac23324d9836cf067111f1f5834c77b1153a8a5d7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-80.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-80.png
                                                            • Size 590B
                                                            • SHA256 91ba72309e34c5336c09b8f5c787a6327082f275d5d7bfe491c5430e67c80752
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-80_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\Assets\70x70Logo.scale-80_contrast-white.png
                                                            • Size 519B
                                                            • SHA256 37b0f1fb4a08af8a42e6d8fce4c7380ddae0272150d7a9bb8b1d138066a9ffbe
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            assistant_package
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\assistant_package
                                                            • Size 4.0MB
                                                            • SHA256 94e3084f1b04722c389ccce1c70129dd62190073ebeccf8c9f9114056c76cef0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            d3dcompiler_47.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\d3dcompiler_47.dll
                                                            • Size 4.5MB
                                                            • SHA256 f7ca62f2dc8e1d509c5ccf46944bc878208afd081705d555e94dd24720f7ba8f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dxcompiler.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\dxcompiler.dll
                                                            • Size 24.6MB
                                                            • SHA256 773065b372d128f44d06f28e43cfa8925e9810ae4aa8ceae6fd2dc277fb5004b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dxil.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\dxil.dll
                                                            • Size 1.4MB
                                                            • SHA256 9a73346619078ecb692d3d4edf8257d89fb9207be215c1a9130b1f1ac115739a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            files_list
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\files_list
                                                            • Size 6KB
                                                            • SHA256 e762b48bcb2cd9bae9f05d9899fa9f09a3290ffe6be0a9a81126b2e73fd1e6ce
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            headless_command_resources.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\headless_command_resources.pak
                                                            • Size 2KB
                                                            • SHA256 e1f2ec7189570bec91b544cd289af7af3dfe03d4694634068d7ae3ce200792f1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            icudtl.dat
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\icudtl.dat
                                                            • Size 10.4MB
                                                            • SHA256 7377adaf7f3aa2170098bd2bc144ee5f8b9677a206b54ce93c0ec392b0a6abea
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer.exe
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe
                                                            • Size 8.4MB
                                                            • SHA256 4c6a3941719ed6e11ac4575e57e09b0610effb73c1587dfa41787f47104437e0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer_helper_64.exe
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer_helper_64.exe
                                                            • Size 606KB
                                                            • SHA256 93f55ac758cd83c0e36f0a5871c4fe1870113002fed56e8252ef98efa6c245bb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            libEGL.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\libEGL.dll
                                                            • Size 454KB
                                                            • SHA256 ccb1ebab658f5d7463c20b8f4af77f4e8f33e0119296de65470cd051d04b80b6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            libGLESv2.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\libGLESv2.dll
                                                            • Size 454KB
                                                            • SHA256 f43971b4da5acda16fd35ca070373f749fa7eb59fd178f86a787575244996152
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            bg.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\bg.pak
                                                            • Size 971KB
                                                            • SHA256 00ac07cecb13eb09eef53eb291b2b26c0745d0de86a86c731385d0425954f5f4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            bn.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\bn.pak
                                                            • Size 1.2MB
                                                            • SHA256 75ac9c3a34ccf86c94bdf5a8ca0ae70ebedb9f646e03c7b4f0569d82e57ac15e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ca.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\ca.pak
                                                            • Size 612KB
                                                            • SHA256 414771d6719e4ed6fcb91202d81020eafc3fd6a2c53a6dd68bc0bde70c7c740c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cs.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\cs.pak
                                                            • Size 612KB
                                                            • SHA256 f439815f547e86b6348290533702843873029a280bd4a1ff71b6912fe3a87eba
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            da.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\da.pak
                                                            • Size 562KB
                                                            • SHA256 f05479863ca3494edac71f59e6b8a3fcce1e63f4065fbc11c7d77d759279a799
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            de.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\de.pak
                                                            • Size 609KB
                                                            • SHA256 23219d3dcc9c881c9cc2703eacdb2cc5aeb486a1f04a166e482144ee140513a0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            el.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\el.pak
                                                            • Size 1.0MB
                                                            • SHA256 b99ca089731382483fd23a8229bb8916e5926a79426892d914feffe750d7d1c7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            en-GB.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\localization\en-GB.pak
                                                            • Size 493KB
                                                            • SHA256 1f0036af476181b98b5ac9b71072c7474f1f4c922fe05427f97953a00b444c4a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer_prefs.json2e1f4213-6cdb-480d-8031-faa42e81c7e2.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json2e1f4213-6cdb-480d-8031-faa42e81c7e2.tmp
                                                            • Size 1KB
                                                            • SHA256 9db94037e2c18b4ef8902af98c8ddd7b24e7d5882c0a9d5731e9dc6739763d80
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Opera Browser.lnk
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\Opera Browser.lnk
                                                            • Size 1KB
                                                            • SHA256 ca5541c7cca4260c77d258da4f0306e07615a3708458639f2e463718f5dd3c98
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            additional_file0.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\additional_file0.tmp
                                                            • Size 2.9MB
                                                            • SHA256 30786977e61add36f7c641facfb7fce1b2ec7c2a0a7e055a172f127a68788556
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            assistant_installer.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\assistant_installer.exe
                                                            • Size 2.4MB
                                                            • SHA256 e8dce277d6edb918499526fadba9902e317496c2af077219f263a7a643467824
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dbgcore.DLL
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\dbgcore.DLL
                                                            • Size 196KB
                                                            • SHA256 c16220edd3787da33dbd3ac2fcbec7de6a13e2baf14ae6105bba68d4efd83628
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dbghelp.dll
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\assistant\dbghelp.dll
                                                            • Size 1.8MB
                                                            • SHA256 990b13e88b4a9985eb5c596078e2ec26a0edcc22169dd71f8a84c7943005306c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            de932af914ba00303d4a2778a383ac9c831101e2.crx
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\de932af914ba00303d4a2778a383ac9c831101e2.crx
                                                            • Size 4.6MB
                                                            • SHA256 7709b01cae20a411b72b40ce900b0058c6dd03167d05da7e42bf3d95ceffd582
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer_prefs_include.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\installer_prefs_include.json
                                                            • Size 228B
                                                            • SHA256 fb510f9f3decb14b00aa8a87149dbbdd4286ee684cce0fab0c996d15aa67d4a6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            installer_prefs_include.json25f8a5f4-a70a-40a4-8a77-d7677418bf74.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\installer_prefs_include.json25f8a5f4-a70a-40a4-8a77-d7677418bf74.tmp
                                                            • Size 1KB
                                                            • SHA256 47c2e2dfa6759393a021b0b4722616f271783429141523f66080d3051870009e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            installer_prefs_include.json9a7f0296-726b-4256-ad99-8bd907ae67cb.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\ea111559-0eb1-472e-bd04-f749ad2c0f89 Opera Installer Temp\opera_package_202610110733371\installer_prefs_include.json9a7f0296-726b-4256-ad99-8bd907ae67cb.tmp
                                                            • Size 243B
                                                            • SHA256 bb34cce4e4c695d363965ea84f9ddc9cb30ce8ee95bcef6140f159be43969430
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            60b9ce8e-18bf-4e9f-b38a-e440cec35510.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\60b9ce8e-18bf-4e9f-b38a-e440cec35510.tmp
                                                            • Size 2.6MB
                                                            • SHA256 19bc35ca347a6560c0183e56da6bee3353737e78aa9eff9111c5ebd897b0cfd5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\7zS4B29A5B8\installer.exe
                                                            • Size 8.4MB
                                                            • SHA256 c2ac35ff3a7e38118be30262da2ba076470c58c10aa7f9a7e5c3b7ce15c73f1b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OpInst.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                                                            • Size 3.1MB
                                                            • SHA256 00a3c50a5977c1982c6244d159f8d8eb1fc42997375410dc27e7c89f8ac117d4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            bg.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\bg.png
                                                            • Size 224KB
                                                            • SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            d39ebf8a-df66-452b-b602-22ae85c8702b.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\d39ebf8a-df66-452b-b602-22ae85c8702b.tmp
                                                            • Size 13KB
                                                            • SHA256 ce8adf970c3290b7ea94c85727c5abe7eb232e16026a1f8f876ad7f3ec03573d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            favicon_opera_one.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4076_255485689\CRX_INSTALL\favicon_opera_one.png
                                                            • Size 2KB
                                                            • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            background.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\background.js
                                                            • Size 87KB
                                                            • SHA256 b199d4f989c63947c53a9d07450038cfe274b7a10e8cc7d688c4049ae14ef63e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            content.js.LICENSE.txt
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\content.js.LICENSE.txt
                                                            • Size 1KB
                                                            • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Active.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\icons\128\Icon_Light_Active.png
                                                            • Size 2KB
                                                            • SHA256 97d9553a4f725354a6d5c3eff11f31285fd89c3b150593f04785b83d0a56efc2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Red.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\icons\128\Icon_Light_Available_Red.png
                                                            • Size 2KB
                                                            • SHA256 9eccebdbdb61efc0cbd8bccf3a5fedc6f9a1ebe5084b160783f90a56cd1efa7b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Yellow.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\icons\128\Icon_Light_Available_Yellow.png
                                                            • Size 2KB
                                                            • SHA256 c165ef60bf3806cd0a7121a8d6cfd06909fc84b38a07d43e809bd7bff564099c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Active.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\icons\32\Icon_Light_Active.png
                                                            • Size 883B
                                                            • SHA256 50aa1dcfa9083b57dd6187752b2c149294210be12d263b793d27daf8d431954c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Red.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\icons\32\Icon_Light_Available_Red.png
                                                            • Size 895B
                                                            • SHA256 2278e95b28851ade57217ab5c7b32598c44e1085693a3e26379643d29fa0a6d1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Yellow.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\icons\32\Icon_Light_Available_Yellow.png
                                                            • Size 895B
                                                            • SHA256 726a50a9c008449ab7bafbf21325bfc72093b7ae6a56c5be90cf8c32a8a44641
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\icons\32\Icon_Light_Neutral.png
                                                            • Size 962B
                                                            • SHA256 e8adb8a9dcca121a1853749ebef122b84a995ebf8775cd27b0dd54bab9840bd1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index.html
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\index.html
                                                            • Size 222B
                                                            • SHA256 fd21c7ca4637b0221250a14b9fcfb6ebc3b734e659ad80151be4bc579db818f1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\manifest.json
                                                            • Size 1KB
                                                            • SHA256 f9c5b362b8ca1fbe3598e8e225c3f7d3ac0f6f1fe050d72c7189edf541b84e80
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            rules.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1456906731\CRX_INSTALL\rules.json
                                                            • Size 839B
                                                            • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_128.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1664286085\CRX_INSTALL\public\icons\logo_128.png
                                                            • Size 7KB
                                                            • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            logo_16.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1664286085\CRX_INSTALL\public\icons\logo_16.png
                                                            • Size 653B
                                                            • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_32.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1664286085\CRX_INSTALL\public\icons\logo_32.png
                                                            • Size 1KB
                                                            • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_48.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1664286085\CRX_INSTALL\public\icons\logo_48.png
                                                            • Size 2KB
                                                            • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_64.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1664286085\CRX_INSTALL\public\icons\logo_64.png
                                                            • Size 2KB
                                                            • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            main.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_2078012703\CRX_INSTALL\main.js
                                                            • Size 47KB
                                                            • SHA256 9cc5e1dd96d76735499257c52d632a0a9e17ed4da929035067dadcc586000335
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_2078012703\CRX_INSTALL\manifest.json
                                                            • Size 1KB
                                                            • SHA256 20379f015b210e6dafac6fdc64b8faa3b2f8a66b0124f7d5d4e3a83b728802d9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_614865541\CRX_INSTALL\_locales\de\messages.json
                                                            • Size 395B
                                                            • SHA256 7f068365742c910bd20d60741e89473e3b422ca92776fcfe7db1529bdfcb3efa
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_614865541\CRX_INSTALL\_locales\en\messages.json
                                                            • Size 396B
                                                            • SHA256 1bcb4888a65788a50ed88f4bd95955d1dafdc950b5ef4609b37f42934a4bf3b9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_614865541\CRX_INSTALL\_locales\es\messages.json
                                                            • Size 398B
                                                            • SHA256 d2c36a6b4b6535152df5adba5c9d85c45ea6898a1b170a4f795c228931cacc5b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_614865541\CRX_INSTALL\_locales\pl\messages.json
                                                            • Size 401B
                                                            • SHA256 c6e32b74d1b21921946f59b9a12cc7b24086e876608d3db3f29628c35b35dbee
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_614865541\CRX_INSTALL\_locales\ru\messages.json
                                                            • Size 463B
                                                            • SHA256 5f08e78f50623ca8140af8d02eb7fd7e56ff8e9538e4449f7ee327a7b2ef292d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_614865541\CRX_INSTALL\_locales\uk\messages.json
                                                            • Size 410B
                                                            • SHA256 95ef7c34001a60c39cc5fb3516081ff901bb65a08db6ed00acd70afb48858675
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_614865541\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                                            • Size 2KB
                                                            • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                            • Size 40B
                                                            • SHA256 e3d81057e0ddda9c1ec3a74b69cc9031aae274da4a0d7edfd49ff8a6b288925f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            BookmarkMergedSurfaceOrdering79d2bad7-38ce-4013-860e-d8623cfdbd87.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarkMergedSurfaceOrdering79d2bad7-38ce-4013-860e-d8623cfdbd87.tmp
                                                            • Size 6B
                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            BookmarksExtraseb78b247-fced-46da-985f-effb19b0c993.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtraseb78b247-fced-46da-985f-effb19b0c993.tmp
                                                            • Size 223KB
                                                            • SHA256 5dcbd7d70010a064b02a02117d559b324ae8bb856d3954e3edafb2b4a7093eb0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Bookmarksf244f188-dfe8-4df3-9de6-fbb5bb0d5836.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Bookmarksf244f188-dfe8-4df3-9de6-fbb5bb0d5836.tmp
                                                            • Size 36KB
                                                            • SHA256 87fd4c180e70612d97cca8d8aa3e4c5b34ad6f5bc23f05038039f4217d190225
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
                                                            • Size 336B
                                                            • SHA256 72c0030f0fbf4b6438c1662ed86e2cbaf3c5a9e0499fce9f7c8f3131d3f4bbfa
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
                                                            • Size 744B
                                                            • SHA256 49fce96ea845e2180562eb45c2df95c0d0f808f582ec660d6a989041b3089fdd
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 48B
                                                            • SHA256 e57bd1e7162723c5012dd2e579c782efe8d16bcc1f5abe37854a9e9bc6c6e9cb
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            data_0
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_0
                                                            • Size 8KB
                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_1
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_1
                                                            • Size 264KB
                                                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_2
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_2
                                                            • Size 8KB
                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_3
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_3
                                                            • Size 8KB
                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.8_0\manifest.json
                                                            • Size 1KB
                                                            • SHA256 a34bc0307423ba5a3fbba7762f1425e4ab37f9155954b282a3e6b5e3b9335d87
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            computed_hashes.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.8_1\_metadata\computed_hashes.json
                                                            • Size 647B
                                                            • SHA256 33292b4957ad26bd5d1fd5f1fb1c6a7d8ed1830cca27b21ef1c6be161bd7c2c0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            verified_contents.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.8_1\_metadata\verified_contents.json
                                                            • Size 1KB
                                                            • SHA256 bcd4d6b1fab1648490bfcd3fbc8d25d438172e9d7a7836f806cf61b2a38d1736
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            scraping-method-Dq4mm50p.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\scraping-method-Dq4mm50p.js
                                                            • Size 6KB
                                                            • SHA256 99c8d4f76ebc9fc6cea115065570a12d41903c93e18c1c6385b5b2e70256eb70
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            service-worker.ts-fle0M1Xd.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\service-worker.ts-fle0M1Xd.js
                                                            • Size 13KB
                                                            • SHA256 4ebb6cb9c3f033302d6a8c31329009082bafeab73c39cca179511b5a972ba8f8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            service-worker-loader.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\service-worker-loader.js
                                                            • Size 49B
                                                            • SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            favicon_opera_one.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\favicon_opera_one.png
                                                            • Size 2KB
                                                            • SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            reader_mode.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\reader_mode.js
                                                            • Size 112KB
                                                            • SHA256 d6671e14f42d8ca03d84a67f459b392123dfa65ad1fcd0c0ec105981ee2cc1c3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            spotify_frame_interceptor.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\spotify_frame_interceptor.js
                                                            • Size 5KB
                                                            • SHA256 71e05e0bba7fa44f282661fc99cc7b824d556dbb32957e027c995b555aae20a5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\_locales\en\messages.json
                                                            • Size 429B
                                                            • SHA256 c6a7161359e3c4fbc4059b7209c585f9aa2306c08e6c39a3003f4b29f2ceb22d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\128\Icon_Light_Neutral.png
                                                            • Size 2KB
                                                            • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\32\Icon_Light_Neutral.png
                                                            • Size 932B
                                                            • SHA256 b8e92f9e9b9dc82799231b8d1b57091a9d0bcdd9b54615f86e8c4e4e5c9f036b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            _ruleset1
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_1\_metadata\generated_indexed_rulesets\_ruleset1
                                                            • Size 987B
                                                            • SHA256 87e9f607b1b2638272f2d825615e33512be1eb9ca28e257950f071ca55772e26
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            verified_contents.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_1\_metadata\verified_contents.json
                                                            • Size 6KB
                                                            • SHA256 1bf53733d8e832f02e1f77027519064e25326b3e76496809acb1745ebe29688e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_1\manifest.json
                                                            • Size 1KB
                                                            • SHA256 fa9f0ac01359d1b3776f60327011a291abff71cfb5b15840ef5382c4a4a0990c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            0489894c-a631-4b3a-86cc-2b08f69baa3c.tmp98fd0501-2a2a-46b1-8af2-e49767607578.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\0489894c-a631-4b3a-86cc-2b08f69baa3c.tmp98fd0501-2a2a-46b1-8af2-e49767607578.tmp
                                                            • Size 27KB
                                                            • SHA256 b8f0a6164e126d0f70798a96f456487080b5473bee571bb9594600f8a53901c7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            3d0c5d76-133c-4ab1-b0cc-80946ed2a1eb.tmpf5d100b0-8fac-4872-90ee-6399958db368.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\3d0c5d76-133c-4ab1-b0cc-80946ed2a1eb.tmpf5d100b0-8fac-4872-90ee-6399958db368.tmp
                                                            • Size 27KB
                                                            • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            4eeeaa48-7da5-4885-8768-88ecafc50414.tmpe6e5595b-73b8-4561-b71f-d57a747a7c9c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\4eeeaa48-7da5-4885-8768-88ecafc50414.tmpe6e5595b-73b8-4561-b71f-d57a747a7c9c.tmp
                                                            • Size 27KB
                                                            • SHA256 1b6cb01715a2de1373f9f3e194921621463532558767bb5d6e1902e9b368ca5c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            9e4562e6-8c25-41dd-a5ff-368abbed09c5.tmp68d05dca-d318-4f50-8b93-f8fe1e929f95.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\9e4562e6-8c25-41dd-a5ff-368abbed09c5.tmp68d05dca-d318-4f50-8b93-f8fe1e929f95.tmp
                                                            • Size 27KB
                                                            • SHA256 3a9c655a88437e331f50a23bb40cb1a3de86277cb1a9488c81c426598cfab0a3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            a25cd476-5c19-4335-9f04-e9def6d41260.tmp69f66242-7b14-433c-9655-abd7584b123d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\a25cd476-5c19-4335-9f04-e9def6d41260.tmp69f66242-7b14-433c-9655-abd7584b123d.tmp
                                                            • Size 27KB
                                                            • SHA256 1c2d3bd473e1870389f6737747a94d5e852790d686cf91b5e22ad83b190eefa3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            b803ffab-ce24-49eb-a570-b5eb161fa02e.tmpb7f38e0f-0406-45e5-ae61-ba295733cd5b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\b803ffab-ce24-49eb-a570-b5eb161fa02e.tmpb7f38e0f-0406-45e5-ae61-ba295733cd5b.tmp
                                                            • Size 27KB
                                                            • SHA256 aaa2c3089c7623aefb9025744747ec651dfa14d9decbe63ce941785b4202f1e6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Network Persistent Statee1deab82-af28-433d-9be9-b5bfda55ad9b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent Statee1deab82-af28-433d-9be9-b5bfda55ad9b.tmp
                                                            • Size 1KB
                                                            • SHA256 90d88bce2ef1e20af29ba82db10b8a8d6fa8c83d09e4ae9ffba12d0d3aaad26b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SCT Auditing Pending Reports
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\SCT Auditing Pending Reports
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Preferences13ba6e11-d5ff-4623-8859-ed1c80796b12.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences13ba6e11-d5ff-4623-8859-ed1c80796b12.tmp
                                                            • Size 16KB
                                                            • SHA256 5d58bf984d4e434f592da985adb0b6933f2ec6d5e34345444b83e95a466f785f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences7ce4f682-1482-4b9f-ad1b-7bee29112677.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences7ce4f682-1482-4b9f-ad1b-7bee29112677.tmp
                                                            • Size 15KB
                                                            • SHA256 8c5084cdd0364b9e92ebe14ccc245a4637ff5be80962e04dc9a48035f0f205ca
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences8c47db5f-f9fb-484f-8f76-79c25a607900.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences8c47db5f-f9fb-484f-8f76-79c25a607900.tmp
                                                            • Size 15KB
                                                            • SHA256 f241abaada08164793e841d6aa7ac03b57a744dab3eb80f165a86236fc50dc00
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences936f75bd-24d5-4839-b127-ce8e30fb77d6.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences936f75bd-24d5-4839-b127-ce8e30fb77d6.tmp
                                                            • Size 10KB
                                                            • SHA256 4b5b0a733f6319e2d09ad3301ea89f4c375225452668abc880cf4929d91eb2e0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Secure Preferences292f6191-2537-44db-8089-bfc23412afbb.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences292f6191-2537-44db-8089-bfc23412afbb.tmp
                                                            • Size 82KB
                                                            • SHA256 d89d232f808a3738753b2d0c39d40bf30ae74a56f9034a368b44276e8ea8859c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Secure Preferencesfc8c5776-b2d7-4980-99dc-02bf5e55044f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferencesfc8c5776-b2d7-4980-99dc-02bf5e55044f.tmp
                                                            • Size 110KB
                                                            • SHA256 830317ff858752521d07fd237cfce5171744e53e9e846044784317e5414bbc17
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                            • Size 360B
                                                            • SHA256 d0da73f7b147b8f8d6301e7a40a4e8646f9d8d8ebec5ccb597034f837a80535e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                            • Size 120B
                                                            • SHA256 db677128039df77d6344ea4e1dfb2eebb663d623c152c3110e0ad7c5ac202434
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                            • Size 360B
                                                            • SHA256 3cd52bc7f11b533cbf149df84cf3eb2dc4efacc98264128c433808218640aa6d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                            • Size 72B
                                                            • SHA256 bcf168fb8fd147bbc65068d26d37e6a6cbce9f946663baa0c04f74296b3133ad
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Shared Dictionary\cache\index
                                                            • Size 24B
                                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            CURRENT
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Site Characteristics Database\CURRENT
                                                            • Size 16B
                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw
                                                            • Size 381B
                                                            • SHA256 5f932a27f81d2a5ee5c9faaf53c7b6b7c48c2cc6919c52d3a947a9fa35bfc6bf
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw022645ea-21e7-4ef8-b56e-8f2c8ae8e116.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw022645ea-21e7-4ef8-b56e-8f2c8ae8e116.tmp
                                                            • Size 1KB
                                                            • SHA256 6524ffc3ae9c451fd293670b3184c2a3db27e7fd8e0d84c1f6a83c08cd82030d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw2a96e864-e35f-49fa-905a-ccc8a36e7b07.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw2a96e864-e35f-49fa-905a-ccc8a36e7b07.tmp
                                                            • Size 797B
                                                            • SHA256 65c248117aeced7dfecda13cf8732c6853efb79c1eab3f4e0cde3fec3df332b3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw34df4412-f9fb-41dc-bd8d-c788ab2639ed.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw34df4412-f9fb-41dc-bd8d-c788ab2639ed.tmp
                                                            • Size 781B
                                                            • SHA256 878366f4690a03ca6066a1fcacb0fad2950640ab21d9fe52d4673ebfce10412e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw5de36eab-02c8-45a1-95a1-1c8dc61b0665.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw5de36eab-02c8-45a1-95a1-1c8dc61b0665.tmp
                                                            • Size 797B
                                                            • SHA256 89b686255698549502cddf8363db7d422135d29fa98ec1d2f1f88e2de3223fe5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw64832da2-d6f1-4e6e-8c1d-3aa1d44de501.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw64832da2-d6f1-4e6e-8c1d-3aa1d44de501.tmp
                                                            • Size 605B
                                                            • SHA256 a5290800a081325d93268c1ccd152d4bd2770b6e189cff7972a2731f670569f9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw752192f3-9aca-4a69-b4d7-08c8898a3cf2.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw752192f3-9aca-4a69-b4d7-08c8898a3cf2.tmp
                                                            • Size 957B
                                                            • SHA256 02b79ea12f0070c2a66f6be49a5c6767494210e9a704dc1c9fd17e66d1e05711
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw9f902d98-1b56-48d5-8224-3106b8d62fec.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.raw9f902d98-1b56-48d5-8224-3106b8d62fec.tmp
                                                            • Size 493B
                                                            • SHA256 6960676df0ee2d2b57abbdf08f9cae232c9f5c159b7fefa2d23262e9a0db4097
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawce79d73c-2633-4ab7-b2d8-f19dc1931c1a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawce79d73c-2633-4ab7-b2d8-f19dc1931c1a.tmp
                                                            • Size 1KB
                                                            • SHA256 b30840e7944e4e860f1467ccf0f7ea151f5d08033448454a032ec21ff82a484b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawec7084e7-ff9c-4931-86e4-4e425c00ed19.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawec7084e7-ff9c-4931-86e4-4e425c00ed19.tmp
                                                            • Size 1KB
                                                            • SHA256 bf1fd837531df4995ad265827ceda9f2bad4e316bf38425e5ab71002fe8eda7c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawef512cce-b561-4974-9123-601dd87daa8d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawef512cce-b561-4974-9123-601dd87daa8d.tmp
                                                            • Size 1KB
                                                            • SHA256 9361b3e743b066feb8d06380e529df06d6d682b35120c52fdc7b1f1e968af033
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawf14d7076-ee9b-46ce-ae59-b3548d299945.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_b3503993-180b-48f9-bf0d-3aa5d3069d1a.rawf14d7076-ee9b-46ce-ae59-b3548d299945.tmp
                                                            • Size 1KB
                                                            • SHA256 d79ddf62954cec67c54b33995a304de4762180220fc96c0e7f1bbbfe924cf59c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw
                                                            • Size 9KB
                                                            • SHA256 d309f1144b8ca1354f565ead37dacdd525832b3e84f4009b071bcf5240035ca9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw
                                                            • Size 381B
                                                            • SHA256 d4add748e57f8832259080546af12ead6f09bee440f62a39b7fedf5428a41f7f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw0727c558-5955-4979-aa9c-989f2a939bd2.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw0727c558-5955-4979-aa9c-989f2a939bd2.tmp
                                                            • Size 10KB
                                                            • SHA256 d195d07ba10e9e66a85185e5f1007623ae0b9f3f228f2cdf7550011231868d14
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw16060253-4993-4ff0-be84-a1ee70af7275.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw16060253-4993-4ff0-be84-a1ee70af7275.tmp
                                                            • Size 1KB
                                                            • SHA256 d6ad142543a4b6f6ff0959383b555e227641a1cb458351f531b1fce210acf3dc
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw1862fdda-1c2c-442c-a362-93fe487d8af1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw1862fdda-1c2c-442c-a362-93fe487d8af1.tmp
                                                            • Size 10KB
                                                            • SHA256 659954674b7642f8bd51aabe6703367abbbb0dcfb252189aebfaca75a8890ac1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw1dc764c2-cfab-4bcc-a0f5-5c9c84af600e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw1dc764c2-cfab-4bcc-a0f5-5c9c84af600e.tmp
                                                            • Size 10KB
                                                            • SHA256 e9b9e5e67e78c7d98f733e18811cc3ddd7aa0b1f8dc90c7b2b5e81b529c41067
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw1dfc2087-926c-4d34-b916-31ece2fd87b1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw1dfc2087-926c-4d34-b916-31ece2fd87b1.tmp
                                                            • Size 8KB
                                                            • SHA256 b3c58046c75617478dbfa431190a8e269ae4bc9fddf36d9417f5f0c1525d3dfb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw21f41439-25fd-4511-b3ae-45ee07b7e43e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw21f41439-25fd-4511-b3ae-45ee07b7e43e.tmp
                                                            • Size 8KB
                                                            • SHA256 30b2cd79ed4d252c211c2163c91b2395e7aeb29a1d9b6ab641f96a840f9625df
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw3163f58b-48b7-4eae-815d-97a97a968f06.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw3163f58b-48b7-4eae-815d-97a97a968f06.tmp
                                                            • Size 7KB
                                                            • SHA256 ece7cad1df21316a5e6c38dcf472903f8342b9494421a0da76305e6b29b642b0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw3b4eb844-40a0-4ff2-893b-7011eeebd42b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw3b4eb844-40a0-4ff2-893b-7011eeebd42b.tmp
                                                            • Size 9KB
                                                            • SHA256 3c6f59af63938e1f7ff5a0ec70614c774f37a0f8872b8c3175f278fe75e22547
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw4085ff3e-5abe-4553-87c5-a157f3ee9143.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw4085ff3e-5abe-4553-87c5-a157f3ee9143.tmp
                                                            • Size 6KB
                                                            • SHA256 1f4e04556d24737addc58a143ca48e07ef4fb5bc777a25f20b0001222c5ac3fb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw48d5529f-981c-4150-a50f-09dc7e0d5494.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw48d5529f-981c-4150-a50f-09dc7e0d5494.tmp
                                                            • Size 493B
                                                            • SHA256 295f3462dc118574ddcb1bc6212f3062b356829f140572f5df0f277dc0ba8d5f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw490dd4ad-c078-4296-a459-adf03c342c41.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw490dd4ad-c078-4296-a459-adf03c342c41.tmp
                                                            • Size 9KB
                                                            • SHA256 9680898306d6a77219d380e62442954e7637a1c5971157cb1628b05ae66547d4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw4943d4b3-53de-4593-9ef6-5d54b1b8a3fe.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw4943d4b3-53de-4593-9ef6-5d54b1b8a3fe.tmp
                                                            • Size 8KB
                                                            • SHA256 ac8a3e45a0719e076deb288a4f2559ea82d2ac3371b34d52272654f746f91a49
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw4aabf14f-1a16-47c5-a9b9-ddd6aca9b7e1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw4aabf14f-1a16-47c5-a9b9-ddd6aca9b7e1.tmp
                                                            • Size 9KB
                                                            • SHA256 631805452074a64af2b021059f67b600da9d091f7981bbf10a563913092a39d6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw51b2ae76-2c2c-4da7-8acb-18d34f423e80.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw51b2ae76-2c2c-4da7-8acb-18d34f423e80.tmp
                                                            • Size 10KB
                                                            • SHA256 208496612fbfbd8318235eec62aad33fec1d55fdb99c40b5a517de8826ae5e44
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw536989f1-ced3-48fc-a1f2-6b8a9c1fe165.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw536989f1-ced3-48fc-a1f2-6b8a9c1fe165.tmp
                                                            • Size 9KB
                                                            • SHA256 82572dd15bc65f9919ab7c4b47a6384427224a3745b372b9de0e2b82e254821d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw5555acfc-4ba4-4b78-b2c7-f56237e98152.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw5555acfc-4ba4-4b78-b2c7-f56237e98152.tmp
                                                            • Size 10KB
                                                            • SHA256 d11fb37f4735565ee4e901ca2c71a2a6bba7f2192b8adcaa38ad916400d36f1b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw60912b26-d795-4346-b40f-c68e53c9ae1e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw60912b26-d795-4346-b40f-c68e53c9ae1e.tmp
                                                            • Size 9KB
                                                            • SHA256 95c07199ff4d5f902f822787bfc5c9d3205aa3b2ab5b2ed60acd37a6442aa97a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw640837fc-aa94-4083-bef5-251689770404.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw640837fc-aa94-4083-bef5-251689770404.tmp
                                                            • Size 973B
                                                            • SHA256 01a2fde2037facff9385ce84f00f688c9ab9bf387f6c0462433b55b7e125f45d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw64391bba-38db-45b8-8053-2426ad971152.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw64391bba-38db-45b8-8053-2426ad971152.tmp
                                                            • Size 9KB
                                                            • SHA256 ca18683905e674d4fd209a7b7b0c8b0f27285a6f9712e7d13570587abbed751b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw685f10a8-fe3d-4496-9ac2-296548fa1c2f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw685f10a8-fe3d-4496-9ac2-296548fa1c2f.tmp
                                                            • Size 9KB
                                                            • SHA256 e5c6293492af0c502a79c36ac709db6643529a06ea486124c6862e1cf34d4656
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw68a865a3-abf7-4fb6-98b0-f25a94e48035.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw68a865a3-abf7-4fb6-98b0-f25a94e48035.tmp
                                                            • Size 621B
                                                            • SHA256 0980a3d911c19c7a50f065dfc9915a44921b2d22864459b3b937144951968975
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw75ecefdb-c683-47f1-842e-6cac9532ff7c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw75ecefdb-c683-47f1-842e-6cac9532ff7c.tmp
                                                            • Size 9KB
                                                            • SHA256 a5f137878b1f57915d8dc5b888c4a6a366d7ccc679e0d7fa8898cbeee13c9a4b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw79e44264-0a6d-471f-9eed-f17ed0c0570a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw79e44264-0a6d-471f-9eed-f17ed0c0570a.tmp
                                                            • Size 749B
                                                            • SHA256 3be7a49d12a528ef44c97641d89b020de55cc63f85aa78bb136f12bd743a82ef
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw7a905c78-241b-4f08-a21e-d1cac2ce8b31.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw7a905c78-241b-4f08-a21e-d1cac2ce8b31.tmp
                                                            • Size 10KB
                                                            • SHA256 815ab0d3859ba6d7199fa15f3c78d8ea4299b24a660785e719301f13cde54713
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw7d426bae-72f0-4a0d-b6b5-9e98427b709d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw7d426bae-72f0-4a0d-b6b5-9e98427b709d.tmp
                                                            • Size 7KB
                                                            • SHA256 4d518b1fc754e4861898fdffca37b732b86132136c39a30d5944708ef4e15241
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw7ec37221-5ae1-4481-809b-2b3cf86f9267.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw7ec37221-5ae1-4481-809b-2b3cf86f9267.tmp
                                                            • Size 8KB
                                                            • SHA256 a8648d467a94d3954807c3a5962dbb783cbe0bb92bf82cbd64e0f73a79def8d6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw84b8ade1-9585-47f7-a9a2-084abc0d4af7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw84b8ade1-9585-47f7-a9a2-084abc0d4af7.tmp
                                                            • Size 11KB
                                                            • SHA256 7a591d517226759dd3d6aaabd3c423e2e64aaa883677ab79e25a3df2e13e6168
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw86ab5fd3-a695-4e8d-ba4f-6f313c4bd79a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw86ab5fd3-a695-4e8d-ba4f-6f313c4bd79a.tmp
                                                            • Size 9KB
                                                            • SHA256 06215ce0fd384629cc1987d66f2dd68a4ce4b1586dd4186d98954c0aed358233
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw89ea10d6-e606-4bd9-a0ce-af41bac0efe0.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw89ea10d6-e606-4bd9-a0ce-af41bac0efe0.tmp
                                                            • Size 8KB
                                                            • SHA256 2905d72ca092966f82f9a40df33b03b6dd65fd6039d8d6f2bec595e3cb3c48d5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw8d0a8629-e4b3-4f57-8288-bd27eabefb6d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw8d0a8629-e4b3-4f57-8288-bd27eabefb6d.tmp
                                                            • Size 1KB
                                                            • SHA256 63549d1d5310eb12ae9770c424421d05118da81d68e4a88d016050fd9a21ed28
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw8d15f726-4771-4aaa-b920-22a215c735c1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw8d15f726-4771-4aaa-b920-22a215c735c1.tmp
                                                            • Size 10KB
                                                            • SHA256 02111fe1f442e0714d247a6a5d9a00c857a58b678efc02be072122d7eec8317b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw8e8e63f3-a07c-4c86-9c7b-ee683f0122a1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw8e8e63f3-a07c-4c86-9c7b-ee683f0122a1.tmp
                                                            • Size 9KB
                                                            • SHA256 42ee38789d4b371aab13b41b215616fa8459ffd1ee46bf015cbbc43fd8584301
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw905caab4-1cb8-4370-a375-c3516e937045.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw905caab4-1cb8-4370-a375-c3516e937045.tmp
                                                            • Size 9KB
                                                            • SHA256 f891aac1350cf98b036a7a46e5aafd82203ffc7097d3b57917096900f1b72f69
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw96558607-6093-4f38-aaf8-5ecb63e92749.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw96558607-6093-4f38-aaf8-5ecb63e92749.tmp
                                                            • Size 1KB
                                                            • SHA256 81cb3f74dbba6528706b49e84055d8c7653c1697ac05ce773409c4e700d09375
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw971eaf79-702c-46b3-b50f-8386a2af1110.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw971eaf79-702c-46b3-b50f-8386a2af1110.tmp
                                                            • Size 8KB
                                                            • SHA256 2c3e322c3cec0cf3385d8fa76a12110ce8ba454bc34403decd902992d19cc8cb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw9f97333f-6434-4f9a-adde-79ecedff7ef7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.raw9f97333f-6434-4f9a-adde-79ecedff7ef7.tmp
                                                            • Size 11KB
                                                            • SHA256 74b7696158213bb43643dca638cdf9207eb08fa93dccfe2ec511033f94058c7a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa17dadb5-4638-4f87-a095-811df9c42353.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa17dadb5-4638-4f87-a095-811df9c42353.tmp
                                                            • Size 1KB
                                                            • SHA256 d902d526fa9bf0e0971380d4ec2ae986aba424722a5545f3b6f15be9f47f879d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa47820eb-86d6-42ff-9832-05901a587142.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa47820eb-86d6-42ff-9832-05901a587142.tmp
                                                            • Size 1KB
                                                            • SHA256 cd92fae60ae4ed225eb8f445b27306b28f37b9bcce36ee4dc0719e2bbb126b6e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa77898f6-148d-43c9-89b8-b052a3a7b688.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa77898f6-148d-43c9-89b8-b052a3a7b688.tmp
                                                            • Size 9KB
                                                            • SHA256 5713b21b65ff93630a315a4232198bdc16c1905016a108e33eaef01d29883bc9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa816fce6-2aad-4ae0-9c25-63af80a7305f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawa816fce6-2aad-4ae0-9c25-63af80a7305f.tmp
                                                            • Size 8KB
                                                            • SHA256 ebdca3029ff545ee1ebdb2451eb3f7c736aecaf83f4bb6a4382f8e3be7458710
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawaa31d5f8-a463-4d65-a959-afb348434863.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawaa31d5f8-a463-4d65-a959-afb348434863.tmp
                                                            • Size 10KB
                                                            • SHA256 e7e24bc87a07360bc897136979a3ae986fbb62b111db00c376b2216a65a394f5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawaecda563-0fa4-46e4-aa94-c0fd67d41007.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawaecda563-0fa4-46e4-aa94-c0fd67d41007.tmp
                                                            • Size 1KB
                                                            • SHA256 331ac4851965509fdac068da42eb890d9b29a47c256926976c8ed35c9ab9372f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawb07eab3f-0c29-4012-aff1-3da5fce0a4e2.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawb07eab3f-0c29-4012-aff1-3da5fce0a4e2.tmp
                                                            • Size 11KB
                                                            • SHA256 49213162ef54669b009f15ff109145918fb0a26b3f4fd11e985419739e4418ef
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawbeef9d83-79f9-40f2-b6dd-277f2dfc0c90.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawbeef9d83-79f9-40f2-b6dd-277f2dfc0c90.tmp
                                                            • Size 9KB
                                                            • SHA256 6a3a21e582a1398c27d96459acc0ff64f0c6047a77af8aa4630ead4715bdc3ed
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawbf5d13ca-0c29-40df-85c6-2b4205bcceb8.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawbf5d13ca-0c29-40df-85c6-2b4205bcceb8.tmp
                                                            • Size 8KB
                                                            • SHA256 17cfe1aad7e694e8004f184cb46f930f4e26e27469a99e696572933b2e447829
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc051462c-61c8-4bd0-8203-05bfc90530bc.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc051462c-61c8-4bd0-8203-05bfc90530bc.tmp
                                                            • Size 9KB
                                                            • SHA256 0db0c4d94ae537fad584635b6221fced24f08e1b762b6a5c1b9a971a17d7a5d1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc2b1acc7-c4ce-4596-b162-cb31e91cd436.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc2b1acc7-c4ce-4596-b162-cb31e91cd436.tmp
                                                            • Size 9KB
                                                            • SHA256 888629b239ff701e2221bf178b94ccf0b9850335304ce3a307d95462f88111cd
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc2b6d807-140a-430c-8730-813d5f8028f7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc2b6d807-140a-430c-8730-813d5f8028f7.tmp
                                                            • Size 10KB
                                                            • SHA256 1771404127272298635948dea5416c92b31b2713d8c61f4b621450973e8432a1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc478a520-f182-4339-a4e8-9e162536b26f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawc478a520-f182-4339-a4e8-9e162536b26f.tmp
                                                            • Size 1KB
                                                            • SHA256 4e44a2248364fcd8efbff27ee185c0b8d4e7aaf70a2345a05828ae6ecad5abff
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawd1514ae4-e4ab-4faa-8f1c-beb6379c5416.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawd1514ae4-e4ab-4faa-8f1c-beb6379c5416.tmp
                                                            • Size 1KB
                                                            • SHA256 c4637f68678103f2070f67838f0a448f564b5de04cd6e8c198f9591715c502e9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawd5075e50-3bdb-4d85-8a6d-40402114ee9a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawd5075e50-3bdb-4d85-8a6d-40402114ee9a.tmp
                                                            • Size 1KB
                                                            • SHA256 761afab82f970c47520d9f468e1c2a89e9eef3e022ba89d787ac1801fb3a605a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawd7fc150a-6971-463b-8ede-e227afec9098.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawd7fc150a-6971-463b-8ede-e227afec9098.tmp
                                                            • Size 10KB
                                                            • SHA256 31b2aadf6428033051030273c0b971a595383447bd5669de1bed087c0d0c2852
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawe12cc741-a167-4ca9-805c-fa614950dd9e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawe12cc741-a167-4ca9-805c-fa614950dd9e.tmp
                                                            • Size 9KB
                                                            • SHA256 3f527ee05e9b1523b532e6bc91c004d876c3a674ac76a7c915b4a175ddb31086
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawe96a94cd-d191-4a23-8cbe-0e9d27475f25.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawe96a94cd-d191-4a23-8cbe-0e9d27475f25.tmp
                                                            • Size 8KB
                                                            • SHA256 293dae4f525d03dbeace2cc0bef9f795333610b04590400a2b244a0c66e21a6c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawec69bc3e-831d-4356-97e2-bd3b7c4520c1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawec69bc3e-831d-4356-97e2-bd3b7c4520c1.tmp
                                                            • Size 8KB
                                                            • SHA256 ecbeaa4b2633937aa2dbe4a3933e0d6c4decfa80d03cedb198aaa350cbeb5eda
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawee6670e5-843a-4750-a818-703638097ea5.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawee6670e5-843a-4750-a818-703638097ea5.tmp
                                                            • Size 6KB
                                                            • SHA256 ad4e414ffcda0134a59cc684674c01d05905aeb56252d9d008e44203163e68f3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawf0466084-d926-47cd-a3a5-bf2e3832a7ff.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawf0466084-d926-47cd-a3a5-bf2e3832a7ff.tmp
                                                            • Size 10KB
                                                            • SHA256 ec8196f67c261dccb99e4571f089f88e7bc691b9a46771be38ba022b5f563835
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawf85162dc-d9cf-42f7-ad8e-fcaea1b50ea7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawf85162dc-d9cf-42f7-ad8e-fcaea1b50ea7.tmp
                                                            • Size 8KB
                                                            • SHA256 361408147fb7d3b8a80d710e6fd42f23b62203fb1fa80e3343f5de82237e140b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawfc69a102-103a-413e-a7b6-d28b71b53a41.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawfc69a102-103a-413e-a7b6-d28b71b53a41.tmp
                                                            • Size 9KB
                                                            • SHA256 1581ff157293ec05d9dc31fbb691f8fae9669575e8ed8379a0b4777adf5afc5c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawfdb867d2-0d35-4918-abd0-9f34bd235f18.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawfdb867d2-0d35-4918-abd0-9f34bd235f18.tmp
                                                            • Size 925B
                                                            • SHA256 f86d2a18f5ca126dbd814ea79dc103510ba5914e7e160a5c8cf0b22049b3668b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawfdd69430-bbd3-451d-9128-4c574a281ab9.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_f58a8989-ee53-4171-8944-3ddd8e4adca2.rawfdd69430-bbd3-451d-9128-4c574a281ab9.tmp
                                                            • Size 6KB
                                                            • SHA256 b2e72e7b35c3a3fa3bd03e75d18bc32e209e7d1a13341da7c47a344e5599744b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MANIFEST-000001
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Sync Data\LevelDB\MANIFEST-000001
                                                            • Size 41B
                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            rhs.dat
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\rhs.dat
                                                            • Size 113KB
                                                            • SHA256 3cd8a5c7b333ea72b91c79163f48c987332bdd82dec6683dea512e8a77003162
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ssdfp4076.0.15368078
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp4076.0.15368078
                                                            • Size 203B
                                                            • SHA256 6b38730f97f03c5c5ca0449af552f04d294d9d5cd8f33c78039af29cca213931
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp4076.0.153680783b969024-4e8d-4274-a3c3-1a908113e7c7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp4076.0.153680783b969024-4e8d-4274-a3c3-1a908113e7c7.tmp
                                                            • Size 1KB
                                                            • SHA256 012d4a89c0643e4c4a8bae8d9de732dff1593e2e8c382fb23329d4cf46a2fd92
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp4076.0.15368078439e865d-2efe-4906-aa78-c8d9ebad84cf.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp4076.0.15368078439e865d-2efe-4906-aa78-c8d9ebad84cf.tmp
                                                            • Size 265B
                                                            • SHA256 ee29ba4ca12e434e1c6b6c5fab4def52185ab7953a24b3078c7da703c9f1b8a7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp4076.0.153680788c6b21ef-acde-42b9-a804-d38c1326d274.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp4076.0.153680788c6b21ef-acde-42b9-a804-d38c1326d274.tmp
                                                            • Size 1023B
                                                            • SHA256 e19d74deb390db1cf93245003901f546b3048b7ea0314c74b86c6b34fa0779a3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959
                                                            • Size 3KB
                                                            • SHA256 0e25c1343784a194ffe2c6d3e3b1802b6a54a18a4e41a7a395c1c931ca624a7e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959
                                                            • Size 456B
                                                            • SHA256 59305e0b94e9b7826edc66123309817412d2cc94294f8826aaee1b539473c821
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.13187589590d9a1fbf-24bd-4e0a-9b8b-3195ff910923.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.13187589590d9a1fbf-24bd-4e0a-9b8b-3195ff910923.tmp
                                                            • Size 3KB
                                                            • SHA256 1e8ca66c95271586e4c6267459959d2eb031ca53bca32d56b4e8f5a532e5696c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959225191f8-c9d5-48d5-948e-a12759b51cc8.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959225191f8-c9d5-48d5-948e-a12759b51cc8.tmp
                                                            • Size 1KB
                                                            • SHA256 1602b25cadfc4ef0aa6dc8c823306b4ac160367ff6f4e8a2378095fad368e7b7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.131875895924ffb4b3-1a43-4938-9e54-eb5f629f9414.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.131875895924ffb4b3-1a43-4938-9e54-eb5f629f9414.tmp
                                                            • Size 1KB
                                                            • SHA256 94119e85cd0bb12db11176de6d15277d3a0c1696b1aba8873e4d163b844fdb8c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.131875895928dc5c29-ce20-4380-8bb0-dd48243edcb5.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.131875895928dc5c29-ce20-4380-8bb0-dd48243edcb5.tmp
                                                            • Size 918B
                                                            • SHA256 e9a91eaf86b889d2477244d491fb724ebb12054c8af8a2b50380009777a45c74
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959399ef475-21c3-4ae5-8667-a4b0a9f78b90.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959399ef475-21c3-4ae5-8667-a4b0a9f78b90.tmp
                                                            • Size 647B
                                                            • SHA256 dcdce4e78b3c5ace7e6b31581f451e59dc874fcc78d5aa6cfbac6e2c22fce44c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.13187589594373dcd2-546c-4d62-bf8c-b9b82dc46920.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.13187589594373dcd2-546c-4d62-bf8c-b9b82dc46920.tmp
                                                            • Size 3KB
                                                            • SHA256 2d7e4af92a6f879705b469bf29d0db34ddea96b7fc4b1ccfc5cfe6919a0f8c55
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.13187589594fcb3eed-df1a-4b6a-842a-1ea7ad336620.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.13187589594fcb3eed-df1a-4b6a-842a-1ea7ad336620.tmp
                                                            • Size 3KB
                                                            • SHA256 20efd63f8d11513899de8dbb4e0f6cac233391bd7476389c861f7604acb59a85
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.13187589596f78082f-fbb7-4d72-bed8-33bd668c12d7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.13187589596f78082f-fbb7-4d72-bed8-33bd668c12d7.tmp
                                                            • Size 824B
                                                            • SHA256 5929d5c823fea911d7795ee869268738ca7401af3b1763f44471eddb53627bb6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.13187589598f2ce5a9-42d4-40fa-8efe-5aaa238a3ece.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.13187589598f2ce5a9-42d4-40fa-8efe-5aaa238a3ece.tmp
                                                            • Size 1KB
                                                            • SHA256 ec48fe3fe978d8874b1b434a32a7fbf19ace65e3b37d3525fd9e9e77cfb7b3b1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959901be533-414c-490f-991a-4ca0d114f8df.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959901be533-414c-490f-991a-4ca0d114f8df.tmp
                                                            • Size 3KB
                                                            • SHA256 ed30624fb5bb95f99701e8e4f51e8ee088953256daaf3101c5213e0b93c9fbf2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.131875895991c1b5e0-b936-41fb-922a-486822ec47cb.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.131875895991c1b5e0-b936-41fb-922a-486822ec47cb.tmp
                                                            • Size 1KB
                                                            • SHA256 fea57fd7e38f93c89d0721ec5d4d42f4cf83552a93b4db048a8318ce8a85444b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959a9330036-eddd-47ac-8c9b-3d89ee476c53.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959a9330036-eddd-47ac-8c9b-3d89ee476c53.tmp
                                                            • Size 737B
                                                            • SHA256 735452c3e404ea455d580207ca01a54d2d7cf1f11883fe74fcf936797ac454c3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959ae7c2b75-015a-4a1a-a7a3-d2afdc83e1df.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959ae7c2b75-015a-4a1a-a7a3-d2afdc83e1df.tmp
                                                            • Size 549B
                                                            • SHA256 a2f3d7a11a73a10e915ee4b99fa9b49c78f62312a3567474da3fa39ba04a943a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959b31db093-0ba2-4601-aeca-7d1b63312b28.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959b31db093-0ba2-4601-aeca-7d1b63312b28.tmp
                                                            • Size 1KB
                                                            • SHA256 6c438c723631eef90b72076b34b7fc3bda67e31a78ec95605f49057a57800120
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959b496a4e7-3250-4b92-9181-3648852a49e0.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959b496a4e7-3250-4b92-9181-3648852a49e0.tmp
                                                            • Size 2KB
                                                            • SHA256 e8e17c26710ba491aa651972bb9e7b3bfdb74b0c2ad03486e9c3e317205e5ab6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959bcfc0bc6-a5c5-4f37-846b-f302dd6ff367.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959bcfc0bc6-a5c5-4f37-846b-f302dd6ff367.tmp
                                                            • Size 1014B
                                                            • SHA256 ff165770d78d0aa293e3e942dd0e558e038e4ce4c06a088a3b37ed1461ec74c6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959c496bf97-b430-489f-8566-9dcba5f59d53.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959c496bf97-b430-489f-8566-9dcba5f59d53.tmp
                                                            • Size 3KB
                                                            • SHA256 ad914b2f6327961943eda84ab0bf96acc54688d10e7ebf372d121d6c41511e52
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959ca0264c1-b95a-4e38-9b9f-4c5428bbcf30.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959ca0264c1-b95a-4e38-9b9f-4c5428bbcf30.tmp
                                                            • Size 3KB
                                                            • SHA256 d5f0263a85da1ed12261f7035b666403303e9a863bf09815d9df6cba8b59b81e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959dd69d452-7e2b-42d9-8067-98a45e2afa49.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959dd69d452-7e2b-42d9-8067-98a45e2afa49.tmp
                                                            • Size 3KB
                                                            • SHA256 f58bb51a0738ec9f587d40333bbe981c039b5d7ed1b59fa5ee544feac9848ec6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959f99be47f-b53d-45cc-b02b-9341ea647a21.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959f99be47f-b53d-45cc-b02b-9341ea647a21.tmp
                                                            • Size 1KB
                                                            • SHA256 16dedcf71b01916978b2d8fa8570d48244d514841755e74ffc1a7d07c6e0ba73
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.1318758959fc6fcb41-65a0-4f0d-8bcf-0db3b2797f03.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.1318758959fc6fcb41-65a0-4f0d-8bcf-0db3b2797f03.tmp
                                                            • Size 1KB
                                                            • SHA256 26b1d62fc883fb42a32d283b4b6689f391d30a3fd914f66022a87ebd19ba9005
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1755656421
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1755656421
                                                            • Size 171B
                                                            • SHA256 24dad53e10e78e504694e657eb192043a392388d7d114fdd6a0b1ad2f981b1de
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1755656421cae8907d-fa06-42cf-ba00-e6e940d9f90f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1755656421cae8907d-fa06-42cf-ba00-e6e940d9f90f.tmp
                                                            • Size 224B
                                                            • SHA256 e875dee5332ffc71a02b7a70974af81c7cf08e014223e959a3298996acdb9855
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1755656421e523ed3c-5220-4974-a5c4-8d1b2ec53a5e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1755656421e523ed3c-5220-4974-a5c4-8d1b2ec53a5e.tmp
                                                            • Size 200B
                                                            • SHA256 883a801550e700797728f24dcd9f0c242a88ad018965d414661b455c61fa8377
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            suggestions_cache.json0875c3c5-6993-4bb8-8dfe-62002242f742.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\suggestions_cache.json0875c3c5-6993-4bb8-8dfe-62002242f742.tmp
                                                            • Size 652KB
                                                            • SHA256 659273e2ccba151691117cb7317d04cc88d9d3f04c9a95a3968b616bdfe78e45
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State
                                                            • Size 5KB
                                                            • SHA256 ab23ccdefad2314b3d79bad8100b7822adbbbb9b16e57049cadf2eb315d64c7d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State95e4fe70-551d-4e91-a413-579e5f82f385.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State95e4fe70-551d-4e91-a413-579e5f82f385.tmp
                                                            • Size 3KB
                                                            • SHA256 58c10a3bfb2ba81827e71b73f67f3e6515042cad4c7c3fcd555680ab1d2fdeae
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            VariationsSafeSeedV2
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSafeSeedV2
                                                            • Size 19B
                                                            • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            VariationsSeedV2c711d056-53a4-475f-82a7-e10872d1d07f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSeedV2c711d056-53a4-475f-82a7-e10872d1d07f.tmp
                                                            • Size 11B
                                                            • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            assistant_prefs.jsonf0d21249-864f-4890-b0f2-47cdec0de8b2.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\assistant_prefs.jsonf0d21249-864f-4890-b0f2-47cdec0de8b2.tmp
                                                            • Size 151B
                                                            • SHA256 b75378ea4dc16ad3ce33cf11d711aca7ce9c06dddb748b48cbc6ca3b23e70e0a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            clipboard_injection_guard_rules.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\clipboard_injection_guard_rules.json
                                                            • Size 6KB
                                                            • SHA256 b8d84b82da3d90323de6cf1b4e3594bf7acb99101c72379b10f4b982f82bd487
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            metadata.jsonba84579a-e4ad-42f2-bcb6-5fb890e39020.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\extensions_crx_cache\metadata.jsonba84579a-e4ad-42f2-bcb6-5fb890e39020.tmp
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6892_1565310733\manifest.json
                                                            • Size 1005B
                                                            • SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            opera-one-dark.jpg
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_1370075029\opera-one-dark.jpg
                                                            • Size 349KB
                                                            • SHA256 70b35d024405f6adfb37715e58cadeefab36e305158a73e8a4cc377bae1a4476
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            persona.ini
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_1370075029\persona.ini
                                                            • Size 217B
                                                            • SHA256 69feb09a5aa11d2badb4cdf17c2ddf7861a97a1d3a6add0ded22e5e9e07defc5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            opera-one.jpg
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_447412218\opera-one.jpg
                                                            • Size 194KB
                                                            • SHA256 2e8375c8ba1c0f5379de54bf4bcb0af7ae0ef3c2a6af07409c8d007ff0685b71
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            persona.ini
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_447412218\persona.ini
                                                            • Size 207B
                                                            • SHA256 7cd803353a8af5af891ddf63908e408d1667cfc4b4d2882c61a0fe734df919ec
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            memory/5244-608-0x00007FFDDEDF0000-0x00007FFDDEDF1000-memory.dmp
                                                            Download

                                                            memory/5244-607-0x00007FFDE0740000-0x00007FFDE0741000-memory.dmp
                                                            Download