Overview

overview

8

Static

static

3

ByteBreake...36.exe

windows10-2004-x64

8

ByteBreake...36.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    93s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 14:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ByteBreaker V1_98869836.exe
  • Size 702KB
  • Sample261014-rz8b2set8v
  • SHA256 74b57e66864831c686f2a1bb445c7ba2a4bd5d985aa9879e67bb8a7c847e04f5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 5 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 56 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 11 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_98869836.exe
    "C:\Users\Admin\AppData\Local\Temp\ByteBreaker V1_98869836.exe"
    1⤵
    • Downloads MZ/PE file
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Users\Admin\AppData\Local\OperaGX_98869836.exe
      C:\Users\Admin\AppData\Local\OperaGX_98869836.exe --silent --allusers=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe --silent --allusers=0 --server-tracking-blob=M2FkN2IyY2UzOTcyYzBhNzJlMGJkODI0NGM1OTBhNmRlY2ZhZDAzNWY1ZTI1NGJlNDdiMDk3NzRjM2Q0MDNiOTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTgwYjQ1YTFlNTNiOTRiMDliMTg0NTAzYmZjNDg0Yzk5IiwidGltZXN0YW1wIjoiMTc5MTk4ODc2Ni4yNTYxIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiODBiNDVhMWU1M2I5NGIwOWIxODQ1MDNiZmM0ODRjOTkiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJjNTNhMGQ1ZS03MjRlLTRiZDYtYTEzMi0wMTY1ZWYwODFjOTIifQ==
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Enumerates connected drives
        • Reads the TCP/IP host and domain name from the registry
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:5296
        • C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff76edcc998,0x7ff76edcc9a8,0x7ff76edcc9b8
          4⤵
          • Executes dropped EXE
          PID:3008
        • C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\installer.exe" --version
          4⤵
          • Executes dropped EXE
          PID:4468
        • C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5296 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_20261014153929" --session-guid=6baaf19d-52bd-4f5f-9fcd-65574b539df0 --server-tracking-blob=NzMxYWMwNmMzZmY5MmY2NGFmNjhlYWUxMzE0OTlhYjBhOTFmMDhlYTQ3ZDY1MzU4MjdkMmY3YzUwNzRkOWZlMDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTgwYjQ1YTFlNTNiOTRiMDliMTg0NTAzYmZjNDg0Yzk5Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkxOTg4NzY2LjI1NjEiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiI4MGI0NWExZTUzYjk0YjA5YjE4NDUwM2JmYzQ4NGM5OSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImM1M2EwZDVlLTcyNGUtNGJkNi1hMTMyLTAxNjVlZjA4MWM5MiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=EC08000000000000
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:1080
          • C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x7ff76edcc998,0x7ff76edcc9a8,0x7ff76edcc9b8
            5⤵
            • Executes dropped EXE
            PID:1132
          • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\installer.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\installer.exe" --backend --initial-pid=5296 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291" --session-guid=6baaf19d-52bd-4f5f-9fcd-65574b539df0 --server-tracking-blob=NzMxYWMwNmMzZmY5MmY2NGFmNjhlYWUxMzE0OTlhYjBhOTFmMDhlYTQ3ZDY1MzU4MjdkMmY3YzUwNzRkOWZlMDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTgwYjQ1YTFlNTNiOTRiMDliMTg0NTAzYmZjNDg0Yzk5Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkxOTg4NzY2LjI1NjEiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiI4MGI0NWExZTUzYjk0YjA5YjE4NDUwM2JmYzQ4NGM5OSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImM1M2EwZDVlLTcyNGUtNGJkNi1hMTMyLTAxNjVlZjA4MWM5MiJ9 --silent --desktopshortcut=1 --install-subfolder=136.0.6008.111
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4976
            • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\installer.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff6cc3cc998,0x7ff6cc3cc9a8,0x7ff6cc3cc9b8
              6⤵
              • Executes dropped EXE
              PID:5652
            • C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes a Windows system DLL name to a user directory
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Suspicious use of WriteProcessMemory
              PID:5712
              • C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xf0d9cc,0xf0d9d8,0xf0d9e4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4444
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:1188
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xa3d9cc,0xa3d9d8,0xa3d9e4
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4388
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:5960
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:4712
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7fff16b21c30,0x7fff16b21c40,0x7fff16b21c50
                      10⤵
                      • Executes dropped EXE
                      PID:5668
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:2724
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x154,0x15c,0x160,0x158,0x164,0x7fff16b21c30,0x7fff16b21c40,0x7fff16b21c50
                      10⤵
                      • Executes dropped EXE
                      PID:3636
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x294,0x298,0x29c,0x250,0x2a0,0xd98324,0xd98330,0xd9833c
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1352
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:4620
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7fff16b21c30,0x7fff16b21c40,0x7fff16b21c50
                        11⤵
                        • Executes dropped EXE
                        PID:1544
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:3860
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x160,0x164,0x168,0x15c,0x16c,0x7fff16b21c30,0x7fff16b21c40,0x7fff16b21c50
                        11⤵
                        • Executes dropped EXE
                        PID:6188
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:6772
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7fff16b21c30,0x7fff16b21c40,0x7fff16b21c50
                        11⤵
                        • Executes dropped EXE
                        PID:6804
            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2036
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x15c,0x160,0x164,0x158,0x168,0x7fff16b21c30,0x7fff16b21c40,0x7fff16b21c50
                7⤵
                • Executes dropped EXE
                PID:1824
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1584,i,5390342156279235160,17503586507042901424,262144 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1856 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:1232
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=2008,i,6300287670399412786,14822636418811822047,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2124 /prefetch:11
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                PID:5716
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=2492,i,17347200700715679694,12280885443038300374,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2660 /prefetch:13
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5516
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3220,i,10155857420111217373,12379169550090998178,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3304 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:4972
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3176,i,4713440441394436899,9418389811033642441,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3232 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:3124
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3240,i,9798393483935087907,11074103545765611935,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3324 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:4656
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3256,i,9658107486788461691,12859394893224385069,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3344 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:1316
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3056,i,14530406250293781212,1142977285347759813,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3200 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3500
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3188,i,9145461117911984541,6831756452577662089,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3284 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:3916
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3396,i,14315588347383674380,13445439047055929023,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3356 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:2104
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_gx_splash.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
                7⤵
                • Executes dropped EXE
                PID:6744
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4764,i,3566374693520357762,11458543538317123309,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4772 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:3040
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4936,i,16979604214666206477,6106602260105669638,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4988 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:4744
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5024,i,9805714938315684267,8127266549685862899,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5068 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:4892
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5344,i,16648003261238770463,10151629952252949421,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5348 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6176
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=5476,i,8838525753217162350,8625177951330847817,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5380 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6208
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=5480,i,3310714897022219170,1245287024235996864,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5552 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6220
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=5484,i,15840456260206104205,12532098292562440492,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5560 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6232
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=5488,i,8652506032311047343,3763196993966522746,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5572 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6256
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6452,i,7769445150182972724,4356784356100527004,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6056 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:1224
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6892,i,7507248092968320066,14967575779679218231,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6936 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:7216
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6800,i,17056516099109133681,857465332745361097,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5596 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:8152
              • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
                7⤵
                • Executes dropped EXE
                PID:7336
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x298,0x29c,0x2a0,0x27c,0x2a4,0x7ff6abd5b598,0x7ff6abd5b5a8,0x7ff6abd5b5b8
                  8⤵
                    PID:4192
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=5636,i,6193416845420302418,961686002873904493,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7496 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:7368
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=5584,i,13968353053229315,9592171543647353441,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=4780 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:7352
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7360,i,5728539398290368515,3926325613848717989,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7448 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:7360
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=6920,i,3959791541049505585,15857050586747496771,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7460 /prefetch:14
                  7⤵
                  • Executes dropped EXE
                  PID:7384
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7416,i,4809780242499922694,15950094468376748543,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=7576 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:7480
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7412,i,2585730222152437641,8353111326932305815,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=7556 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:7524
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7428,i,3450401375845073657,6727589218717724473,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=7596 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:7512
                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7396,i,11980441484110004399,17864850547191508176,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7536 /prefetch:14
                  7⤵
                    PID:7468
                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=5940,i,9663666766011844577,17054872061032029,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=6772 /prefetch:14
                    7⤵
                      PID:7432
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7372,i,3210500372968946914,2643769275725400345,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6904 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:7408
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7232,i,12542847368005562278,11001744308150587439,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7516 /prefetch:14
                      7⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:7392
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=6712,i,6131815613371694231,8423199661521558703,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7476 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:7528
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7444,i,15307538577078684639,9565522541772536584,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8796 /prefetch:12
                      7⤵
                      • Enumerates system info in registry
                      PID:7688
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=9192,i,16776702494798254522,5717467204015791903,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9204 /prefetch:9
                      7⤵
                      • Enumerates system info in registry
                      PID:7444
                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=9364,i,13519913573452687836,14353608209991108119,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9268 /prefetch:14
                      7⤵
                        PID:6336
                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10000,i,8929994352652424479,6314393080751394264,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10024 /prefetch:14
                        7⤵
                          PID:4416
                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10032,i,8412208580236032364,13970972279720339896,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10172 /prefetch:14
                          7⤵
                            PID:3328
                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10340,i,16284623962152294239,1338887094387708373,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10320 /prefetch:14
                            7⤵
                              PID:6860
                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=10488,i,11285411626654692218,7649213017178952242,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10528 /prefetch:1
                              7⤵
                                PID:7568
                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10612,i,16781358899458041488,7298771768288743200,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10636 /prefetch:14
                                7⤵
                                  PID:7848
                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10892,i,11472439582089368346,6136786274621657466,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10928 /prefetch:14
                                  7⤵
                                    PID:2688
                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=11064,i,7663136105450354142,15288698020345909739,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11076 /prefetch:14
                                    7⤵
                                      PID:7720
                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=8320,i,8378407246147689822,17595063391796626544,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=3356 /prefetch:14
                                      7⤵
                                        PID:4340
                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7952,i,6680285596062461948,11731994382803545949,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=7476 /prefetch:14
                                        7⤵
                                          PID:7648
                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=6608,i,17229905010893904701,5333505528634964417,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=7524 /prefetch:14
                                          7⤵
                                            PID:7644
                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=8976,i,3892699268062093869,89680130326913705,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=9000 /prefetch:14
                                            7⤵
                                              PID:2732
                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=8952,i,15946806813131025892,160540635759889017,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=9048 /prefetch:14
                                              7⤵
                                                PID:6404
                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7724,i,13093835616159409359,9305170238668326994,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=8912 /prefetch:14
                                                7⤵
                                                  PID:6620
                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10492,i,17580897675002312262,15489878453756680837,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=4196 /prefetch:14
                                                  7⤵
                                                    PID:6624
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=7908,i,12068610215216092105,17813127639265178624,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7900 /prefetch:14
                                                    7⤵
                                                      PID:8076
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=8240,i,9885530832279363019,13723494981207382400,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=8212 /prefetch:14
                                                      7⤵
                                                        PID:6480
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10968,i,11543469159804738844,11100197785847947670,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=11044 /prefetch:14
                                                        7⤵
                                                          PID:6764
                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3560,i,198090914509401655,8299591810067397490,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=5480 /prefetch:14
                                                          7⤵
                                                            PID:2260
                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10964,i,14154641827200485958,3291872562863966306,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=3832 /prefetch:14
                                                            7⤵
                                                              PID:8112
                                                            • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=3780,i,6039093365673079812,16698985443800086832,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=10840 /prefetch:14
                                                              7⤵
                                                                PID:8032
                                                              • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=3892,i,15807138160607468749,11476388358246740861,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=3884 /prefetch:9
                                                                7⤵
                                                                  PID:6304
                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --metrics-shmem-handle=10316,i,2188447810099949708,12796649555945570316,524288 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=8560 /prefetch:14
                                                                  7⤵
                                                                    PID:6364
                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=10060,i,16267110779135048152,16884649589076951076,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=8260 /prefetch:9
                                                                    7⤵
                                                                      PID:6520
                                                                    • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                      "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=10480,i,1119764960882902840,3581135490584986787,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=4124 /prefetch:9
                                                                      7⤵
                                                                        PID:4656
                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8564,i,11268482439772291989,9625903296557806974,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=5568 /prefetch:9
                                                                        7⤵
                                                                          PID:9092
                                                                        • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                          "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=3552,i,13418395305652616070,10616874855557586599,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=3564 /prefetch:9
                                                                          7⤵
                                                                            PID:8248
                                                                          • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                            "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:continue-on-support-with-booking=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-gaming-extension=on --with-feature:gx-post-mortem=on --with-feature:gx-widgets-mission=on --with-feature:in-house-autocomplete-send=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=DNA-112027-gx-mission-widget-on:DNA-112027 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=4152,i,2516041384184187341,8236352500575597668,2097152 --field-trial-handle=1860,i,10558871685867036061,8428356705760303309,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureVideoHeuristics,BrowserInitiatedAutomaticPictureInPicture,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1868,i,5522384017316319464,550859756175971638,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=8384 /prefetch:9
                                                                            7⤵
                                                                              PID:8488
                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Writes a Windows system DLL name to a user directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1216
                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe" --version
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Enumerates system info in registry
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5596
                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xf0d9cc,0xf0d9d8,0xf0d9e4
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5132
                                                                  • C:\Program Files\Booster\GameBooster.exe
                                                                    "C:\Program Files\Booster\GameBooster.exe" install
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4964
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\GameBooster_CreateStartupTask.ps1"
                                                                      3⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2448
                                                                  • C:\Users\Admin\AppData\Local\AIChat_98869836.exe
                                                                    C:\Users\Admin\AppData\Local\AIChat_98869836.exe /S
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:872
                                                                    • C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                                                      "C:\Users\Admin\AppData\Local\aichat\aichat.exe" --hidden
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • Checks whether UAC is enabled
                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                      • Modifies system certificate store
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3140
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3140.4708.3123189917416726868 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                        4⤵
                                                                        • Enumerates system info in registry
                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5424
                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView /prefetch:4 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff40615fd8,0x7fff40615fe4,0x7fff40615ff0
                                                                          5⤵
                                                                            PID:1400
                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1708 --field-trial-handle=1712,i,9532515398365161785,11025744223487953283,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                            5⤵
                                                                              PID:2008
                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1712,i,9532515398365161785,11025744223487953283,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                              5⤵
                                                                                PID:4680
                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1712,i,9532515398365161785,11025744223487953283,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                                5⤵
                                                                                  PID:3224
                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3492 --field-trial-handle=1712,i,9532515398365161785,11025744223487953283,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6 /prefetch:1
                                                                                  5⤵
                                                                                    PID:5128
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView" --webview-exe-name=aichat.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2020 --field-trial-handle=1712,i,9532515398365161785,11025744223487953283,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d1118be78b457af6e082c6802c448b2df9ba5cc6
                                                                                    5⤵
                                                                                      PID:6796
                                                                              • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1512
                                                                                • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                                  C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:WfR2Sy1rQgeGdt0CNiPOPN -o:0
                                                                                  3⤵
                                                                                    PID:7376
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:2424
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:3736
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:6372
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:3640
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:7376
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:8132
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:6384
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:9048
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:9188
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:8308
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:6212
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                1⤵
                                                                                  PID:3592
                                                                                • C:\Program Files\Booster\GameBooster.exe
                                                                                  "C:\Program Files\Booster\GameBooster.exe"
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1116
                                                                                  • C:\Program Files\Booster\GameBooster.exe
                                                                                    "C:\Program Files\Booster\GameBooster.exe" --minimized
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:1368
                                                                                • C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
                                                                                  "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --autostart
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Enumerates system info in registry
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:7032
                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe
                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x158,0x15c,0x160,0x154,0x164,0x7fff16b21c30,0x7fff16b21c40,0x7fff16b21c50
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:7072
                                                                                • C:\Windows\system32\wbem\unsecapp.exe
                                                                                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                  1⤵
                                                                                    PID:7040
                                                                                  • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                    "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
                                                                                    1⤵
                                                                                      PID:7664
                                                                                      • C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x294,0x298,0x29c,0x22c,0x2a0,0x7ff6abd5b598,0x7ff6abd5b5a8,0x7ff6abd5b5b8
                                                                                        2⤵
                                                                                          PID:8092
                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\9B44A87EC5AC\installer.exe" --version
                                                                                          2⤵
                                                                                            PID:3752
                                                                                        • C:\Program Files (x86)\PremierOpinion\pmservice.exe
                                                                                          "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
                                                                                          1⤵
                                                                                            PID:8116
                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                              C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1608
                                                                                              2⤵
                                                                                                PID:2044
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
                                                                                                2⤵
                                                                                                  PID:7388
                                                                                                • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                                  "c:\program files (x86)\premieropinion\pmropn.exe" -boot
                                                                                                  2⤵
                                                                                                    PID:7876
                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                      CheckNetIsolation.exe LoopbackExempt -s
                                                                                                      3⤵
                                                                                                        PID:4796
                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                        CheckNetIsolation.exe LoopbackExempt -s
                                                                                                        3⤵
                                                                                                          PID:6488
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 7876
                                                                                                        2⤵
                                                                                                          PID:8460
                                                                                                          • C:\PROGRA~2\PREMIE~1\pmropn32.exe
                                                                                                            C:\PROGRA~2\PREMIE~1\pmropn32.exe 7876
                                                                                                            3⤵
                                                                                                              PID:8892
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 7876
                                                                                                            2⤵
                                                                                                              PID:7368
                                                                                                              • C:\PROGRA~2\PREMIE~1\pmropn64.exe
                                                                                                                C:\PROGRA~2\PREMIE~1\pmropn64.exe 7876
                                                                                                                3⤵
                                                                                                                  PID:9152
                                                                                                              • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                                                                "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
                                                                                                                2⤵
                                                                                                                  PID:6408
                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
                                                                                                                    3⤵
                                                                                                                      PID:7648
                                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
                                                                                                                      3⤵
                                                                                                                        PID:7396
                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
                                                                                                                        3⤵
                                                                                                                          PID:6300
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            4⤵
                                                                                                                              PID:3916
                                                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.sechealthui_8wekyb3d8bbwe
                                                                                                                            3⤵
                                                                                                                              PID:7640
                                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.8_8wekyb3d8bbwe
                                                                                                                              3⤵
                                                                                                                                PID:8212
                                                                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
                                                                                                                                3⤵
                                                                                                                                  PID:9028
                                                                                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
                                                                                                                                  3⤵
                                                                                                                                    PID:8996
                                                                                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
                                                                                                                                    3⤵
                                                                                                                                      PID:8372
                                                                                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
                                                                                                                                      3⤵
                                                                                                                                        PID:8440
                                                                                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
                                                                                                                                        3⤵
                                                                                                                                          PID:8400
                                                                                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
                                                                                                                                          3⤵
                                                                                                                                            PID:8548
                                                                                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy
                                                                                                                                            3⤵
                                                                                                                                              PID:8616
                                                                                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
                                                                                                                                              3⤵
                                                                                                                                                PID:1316
                                                                                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:8768

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                  Reconnaissance

                                                                                                                                                  Resource Development

                                                                                                                                                  Initial Access

                                                                                                                                                  Execution

                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                  1
                                                                                                                                                  T1059

                                                                                                                                                  PowerShell

                                                                                                                                                  1
                                                                                                                                                  T1059.001

                                                                                                                                                  Persistence

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Event Triggered Execution

                                                                                                                                                  1
                                                                                                                                                  T1546

                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1546.015

                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                  1
                                                                                                                                                  T1574

                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1574.001

                                                                                                                                                  Privilege Escalation

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Event Triggered Execution

                                                                                                                                                  1
                                                                                                                                                  T1546

                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1546.015

                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                  1
                                                                                                                                                  T1574

                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1574.001

                                                                                                                                                  Defense Evasion

                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                  1
                                                                                                                                                  T1574

                                                                                                                                                  DLL Search Order Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1574.001

                                                                                                                                                  Masquerading

                                                                                                                                                  1
                                                                                                                                                  T1036

                                                                                                                                                  Match Legitimate Name or Location

                                                                                                                                                  1
                                                                                                                                                  T1036.005

                                                                                                                                                  Modify Registry

                                                                                                                                                  3
                                                                                                                                                  T1112

                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                  1
                                                                                                                                                  T1553

                                                                                                                                                  Install Root Certificate

                                                                                                                                                  1
                                                                                                                                                  T1553.004

                                                                                                                                                  Credential Access

                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                  1
                                                                                                                                                  T1555

                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                  1
                                                                                                                                                  T1555.003

                                                                                                                                                  Unsecured Credentials

                                                                                                                                                  1
                                                                                                                                                  T1552

                                                                                                                                                  Credentials In Files

                                                                                                                                                  1
                                                                                                                                                  T1552.001

                                                                                                                                                  Discovery

                                                                                                                                                  Network Share Discovery

                                                                                                                                                  1
                                                                                                                                                  T1135

                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                  1
                                                                                                                                                  T1120

                                                                                                                                                  Query Registry

                                                                                                                                                  5
                                                                                                                                                  T1012

                                                                                                                                                  System Information Discovery

                                                                                                                                                  5
                                                                                                                                                  T1082

                                                                                                                                                  System Location Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614

                                                                                                                                                  System Language Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614.001

                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                  1
                                                                                                                                                  T1016

                                                                                                                                                  System Time Discovery

                                                                                                                                                  1
                                                                                                                                                  T1124

                                                                                                                                                  Lateral Movement

                                                                                                                                                  Collection

                                                                                                                                                  Data from Local System

                                                                                                                                                  1
                                                                                                                                                  T1005

                                                                                                                                                  Command and Control

                                                                                                                                                  Exfiltration

                                                                                                                                                  Impact

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  snt.dat.bac
                                                                                                                                                  • Path C:\PROGRA~2\PREMIE~1\snt.dat.bac
                                                                                                                                                  • Size 3.4MB
                                                                                                                                                  • SHA256 2797cb14d86fe5e2d40632988c1ae64aec2d5d0af16a07ecaffdef2031b8b8e9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  snt.dat.bac
                                                                                                                                                  • Path C:\PROGRA~2\PREMIE~1\snt.dat.bac
                                                                                                                                                  • Size 3.4MB
                                                                                                                                                  • SHA256 fc39a3cd32e8364e84e229bb68a69c66df3d4617c153169925accdd5549c2f70
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  cacert.pem
                                                                                                                                                  • Path C:\Program Files (x86)\PremierOpinion\cacert.pem
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmoci.bin
                                                                                                                                                  • Path C:\Program Files (x86)\PremierOpinion\pmoci.bin
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 20b0f94844860501e115fccd5c1462b2e2c932041d7989dc51c6d885b3429d8a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  103621DE9CD5414CC2538780B4B75751
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                                                                                                  • Size 808B
                                                                                                                                                  • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  56E83C5857C173AD065FC47EB887B239
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
                                                                                                                                                  • Size 185KB
                                                                                                                                                  • SHA256 4288d88c9d7ec094b6b1cd6dfc574101d535f9b26b69950f7f966b6cedff7e61
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                                  • Size 280B
                                                                                                                                                  • SHA256 ae40373964e244ad13d16a7cd24266ee17a26516ef12a78d860be9b14f6bacdd
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                  • Size 471B
                                                                                                                                                  • SHA256 a7c388043208fc063435f0b80680eb5dea6e2e18335c33414bcd89e24000cfca
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  103621DE9CD5414CC2538780B4B75751
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                                                                                                  • Size 192B
                                                                                                                                                  • SHA256 dcd1276bb38166147be7c9113d5a4055a04c78f7d35e42da18db6323f470a036
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  56E83C5857C173AD065FC47EB887B239
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
                                                                                                                                                  • Size 246B
                                                                                                                                                  • SHA256 22384b001240bd7be541cc2eea2de099e295c67997a8c7f308b6763be945575d
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9FA314C8877B1FA1F912B4C18662AEE
                                                                                                                                                  • Size 484B
                                                                                                                                                  • SHA256 6be2eaca4c63dfdcedbb24e24cb826e99db22169ce2b6550e8e232bfb2b7506c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                                                                                                                  • Size 416B
                                                                                                                                                  • SHA256 cf4d468cb2a7820e7cfb3c77a29ddc6661a311b99c513eaa74a42c6279e3b220
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  AIChat_98869836.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\AIChat_98869836.exe
                                                                                                                                                  • Size 3.6MB
                                                                                                                                                  • SHA256 6430a772eb047467aa0c3e4bc964719dbf85b9adc58e63738a8652099ba6f8ec
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ContentI3[1].exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9D1I77B7\ContentI3[1].exe
                                                                                                                                                  • Size 3.8MB
                                                                                                                                                  • SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  log-conversion[1].json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9D1I77B7\log-conversion[1].json
                                                                                                                                                  • Size 16B
                                                                                                                                                  • SHA256 6489d6d7a33c5d40e18fc61eeb6c34c341279ee61816394dde5189aa4ad8fae5
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  GameBooster[1].exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XDW2KZVM\GameBooster[1].exe
                                                                                                                                                  • Size 715KB
                                                                                                                                                  • SHA256 3bf07d3bfa2cb446e0bcbe889647a0734ab0255edf6b7290ac4c3e9d2e667fef
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  hgsdk[1].dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XDW2KZVM\hgsdk[1].dll
                                                                                                                                                  • Size 7.4MB
                                                                                                                                                  • SHA256 2720d215168108700767f8e9b57819d55ca139d69d8d828186da186850a37c6c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  snapshot-new.baf
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\Cache\No_Vary_Search\snapshot-new.baf
                                                                                                                                                  • Size 20B
                                                                                                                                                  • SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  f_000001
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Opera Software\Opera GX Stable\Default\System Cache\Cache_Data\f_000001
                                                                                                                                                  • Size 215KB
                                                                                                                                                  • SHA256 9b0005326b57d0f86cdb8f8ac9d4393e248f42b9a35ebdfb098b4c0e8188ac24
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  OperaGX_98869836.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\OperaGX_98869836.exe
                                                                                                                                                  • Size 4.0MB
                                                                                                                                                  • SHA256 4bd557477190c318f9c6052e5ab7feae9cab428573414f3052115a354c87b4ef
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  136.0.6008.111.manifest
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\136.0.6008.111.manifest
                                                                                                                                                  • Size 227B
                                                                                                                                                  • SHA256 abef517b59ebab5bb82664db6f8581d3f96410c78d0c3a9ba1c36ffeeeafe8bc
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  150x150Logo.scale-100.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-100.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 9635c074c9d8edde0baf3111dbd7db49cbdc370c4f729c80ac382949f32be526
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  150x150Logo.scale-100_contrast-white.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-100_contrast-white.png
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 28ce8fcb22080ce1f69346cb0720bbe5662959e413426f00062b706013da8c28
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  150x150Logo.scale-140.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-140.png
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 a36a13a5d5e3d39e3018ccc5f8859944c87256f8be24a3c08a6bf3cb06a26804
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  150x150Logo.scale-140_contrast-white.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-140_contrast-white.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 0bd63fe653885286e180fbdf6d1dadc66af242b8ed6bd1d03d8c5eccc20e91d7
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  150x150Logo.scale-180.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-180.png
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 6a8f64754c75edcc9abc1138e44acbd7064d7e8e2a28783939241dbd6afa30a5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  150x150Logo.scale-180_contrast-white.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-180_contrast-white.png
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 a706b332e6a846357a86c30d0e8bb7697e7dd55c2ae592dd45611ddce0c0bf14
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  150x150Logo.scale-80.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-80.png
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 7e6b0d9ea7fda1b5ca7a0b01290521dff943da4cbf1498412ca7d749db42c32d
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  installer.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\136.0.6008.111\installer.exe
                                                                                                                                                  • Size 9.2MB
                                                                                                                                                  • SHA256 169fea73a8c14eb679783511e00574feedab1dca6e95a1c0d5e1e91e3e91e16c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  installer_prefs.json064bfcfc-e500-4d0b-ab5e-04cadbf7067d.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Programs\Opera GX\installer_prefs.json064bfcfc-e500-4d0b-ab5e-04cadbf7067d.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 1322bcfeb123240a2b076dc3fec3c9a71b3e9effdb1f7850a223471e53f9426d
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Opera GX Browser.lnk
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\Opera GX Browser.lnk
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 0acf45524623f8e54ff07f4c2ceec15121b55b7e796047a7b1a993ddaaa02a3e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  additional_file1.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\additional_file1.tmp
                                                                                                                                                  • Size 2.9MB
                                                                                                                                                  • SHA256 9a154db5e47d28470453ea69f3d7a9771af48d3eafd71b4fc62538aa2c19f92d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  assistant_installer.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\assistant_installer.exe
                                                                                                                                                  • Size 2.5MB
                                                                                                                                                  • SHA256 510ce6cf7d9bd4932e8188e0810073def5ccc9b783f90cdfbf4d7e3bda8de967
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  dbgcore.DLL
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\dbgcore.DLL
                                                                                                                                                  • Size 196KB
                                                                                                                                                  • SHA256 49ef54a43abea102f40f0f6628192b0a8ecddeea33339f04ff536de7383782e6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  dbghelp.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\assistant\dbghelp.dll
                                                                                                                                                  • Size 1.8MB
                                                                                                                                                  • SHA256 9df3c15a741948a19b6cf3ea511ec703a1eef673af230fd99fe4dffde7e663e1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  installer_prefs_include.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\installer_prefs_include.json
                                                                                                                                                  • Size 342B
                                                                                                                                                  • SHA256 607bb2f8c7c6cd3fa04e3add4e9c8a024ea23bba1798a189f4db1cdcd5ddad53
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  installer_prefs_include.json5446b9e5-0dc7-4407-ad3f-852ab516dad4.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\installer_prefs_include.json5446b9e5-0dc7-4407-ad3f-852ab516dad4.tmp
                                                                                                                                                  • Size 357B
                                                                                                                                                  • SHA256 02220de7d021c824f78eba743a56b0d2cf2f002f06e547d9d601ce974f7e9aa1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  installer_prefs_include.jsonb49eeb21-8d2e-410d-81c8-0498c8e802b0.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\installer_prefs_include.jsonb49eeb21-8d2e-410d-81c8-0498c8e802b0.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 7c2e170d572fd4ea9eae7f372b6b6e473b122e11aa2534f0cc123010fc8e322e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  custom_partner_content.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.opera\322b3f17-8b24-46ae-8050-1c4a6129e26c Opera GX Installer Temp\opera_package_202610141539291\resources\custom_partner_content.json
                                                                                                                                                  • Size 245KB
                                                                                                                                                  • SHA256 84bc1efb211c6b45f2906278a36f1414922f994a9611bbee7713ffd4ae21e967
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  19ad06f0-ce13-41c8-929f-59078c511d92.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\19ad06f0-ce13-41c8-929f-59078c511d92.tmp
                                                                                                                                                  • Size 4.6MB
                                                                                                                                                  • SHA256 7709b01cae20a411b72b40ce900b0058c6dd03167d05da7e42bf3d95ceffd582
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  35ac579a-4454-4fff-9fca-cde38e33b914.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\35ac579a-4454-4fff-9fca-cde38e33b914.tmp
                                                                                                                                                  • Size 13KB
                                                                                                                                                  • SHA256 ce8adf970c3290b7ea94c85727c5abe7eb232e16026a1f8f876ad7f3ec03573d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  460cab7b-c6ec-45a0-93b1-61d8f615e846.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\460cab7b-c6ec-45a0-93b1-61d8f615e846.tmp
                                                                                                                                                  • Size 46KB
                                                                                                                                                  • SHA256 176a736c95c08746480a0e25f7acf323d502d0f6aac4b4dfbeb2713513af8a52
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  496fd89c-dcc9-4685-ba6f-2d5801cbb8d9.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\496fd89c-dcc9-4685-ba6f-2d5801cbb8d9.tmp
                                                                                                                                                  • Size 472KB
                                                                                                                                                  • SHA256 4b9b79291aca9c45d54ae238655f41b7a0eecb0b80fb3d172cd0b1d75e712540
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  4b25ba6f-6431-47ae-adcc-5c5a2ada27ff.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\4b25ba6f-6431-47ae-adcc-5c5a2ada27ff.tmp
                                                                                                                                                  • Size 2.6MB
                                                                                                                                                  • SHA256 19bc35ca347a6560c0183e56da6bee3353737e78aa9eff9111c5ebd897b0cfd5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  installer.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zSCF452EA9\installer.exe
                                                                                                                                                  • Size 9.2MB
                                                                                                                                                  • SHA256 7451506a62bf3792c250d641d560bbc98274904703075509514bb4e36bdd3ad1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  GameBooster_CreateStartupTask.ps1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_CreateStartupTask.ps1
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 e44dce271422bf943413d99eef29114e49d91571422d58e5710d8df5616669ef
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  GameBooster_log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\GameBooster_log.txt
                                                                                                                                                  • Size 126B
                                                                                                                                                  • SHA256 9129d88573d3f0c4e9b2490de0fb58aa5a4b6dec6d646c74525abf221e119d66
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  __PSScriptPolicyTest_f51vlequ.mk5.psm1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f51vlequ.mk5.psm1
                                                                                                                                                  • Size 60B
                                                                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  aichat-startup.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\aichat-startup.log
                                                                                                                                                  • Size 411B
                                                                                                                                                  • SHA256 cfce5508342b2cf3b1ce827997276643d034022fe9d2db6d20a9a1efb883a4da
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  System.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa6852.tmp\System.dll
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  nsis_tauri_utils.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa6852.tmp\nsis_tauri_utils.dll
                                                                                                                                                  • Size 33KB
                                                                                                                                                  • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  favicon_opera_one.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_103984488\CRX_INSTALL\favicon_opera_one.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  messages.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_123470957\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                                  • Size 396B
                                                                                                                                                  • SHA256 1bcb4888a65788a50ed88f4bd95955d1dafdc950b5ef4609b37f42934a4bf3b9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Neutral.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_123470957\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Neutral.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_123470957\CRX_INSTALL\icons\32\Icon_Light_Neutral.png
                                                                                                                                                  • Size 962B
                                                                                                                                                  • SHA256 e8adb8a9dcca121a1853749ebef122b84a995ebf8775cd27b0dd54bab9840bd1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo_128.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_1324592386\CRX_INSTALL\public\icons\logo_128.png
                                                                                                                                                  • Size 7KB
                                                                                                                                                  • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo_16.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_1324592386\CRX_INSTALL\public\icons\logo_16.png
                                                                                                                                                  • Size 653B
                                                                                                                                                  • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo_32.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_1324592386\CRX_INSTALL\public\icons\logo_32.png
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo_48.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_1324592386\CRX_INSTALL\public\icons\logo_48.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo_64.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_1324592386\CRX_INSTALL\public\icons\logo_64.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  messages.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_986428782\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 13f83e7ad61d853293597de9e7583e7724680b7c80c31d0834097f2a7022741a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmls.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~osD515.tmp\pmls.dll
                                                                                                                                                  • Size 884KB
                                                                                                                                                  • SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmls64.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~osD515.tmp\pmls64.dll
                                                                                                                                                  • Size 1.1MB
                                                                                                                                                  • SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmph.dll
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~osD515.tmp\pmph.dll
                                                                                                                                                  • Size 806KB
                                                                                                                                                  • SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmropn.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~osD515.tmp\pmropn.exe
                                                                                                                                                  • Size 7.4MB
                                                                                                                                                  • SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmropn32.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~osD515.tmp\pmropn32.exe
                                                                                                                                                  • Size 244KB
                                                                                                                                                  • SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmropn64.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~osD515.tmp\pmropn64.exe
                                                                                                                                                  • Size 303KB
                                                                                                                                                  • SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pmservice.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~osD515.tmp\pmservice.exe
                                                                                                                                                  • Size 4.6MB
                                                                                                                                                  • SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  aichat.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\aichat\aichat.exe
                                                                                                                                                  • Size 13.1MB
                                                                                                                                                  • SHA256 b085082eb2af43465549651cb3cd42145861f8f9d7de68b2e37a5671a09c0a68
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  23ae2c60-fc3d-4d47-819a-0bd9e47c5984.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\23ae2c60-fc3d-4d47-819a-0bd9e47c5984.tmp
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 7700e2f8b37ad50f5f99e2962857ee1b54985d3663998c0e4c8b9d94ab06cab6
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  255f253a-222f-424e-97b3-470f92ce202b.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\255f253a-222f-424e-97b3-470f92ce202b.tmp
                                                                                                                                                  • Size 15KB
                                                                                                                                                  • SHA256 eb7b35f6a60c4a770fa5200e101c0c873bf8cc6299e95ad4b462a0cf59ed759b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  5cb6229f-69ab-49fb-ab17-4a3e3ef26bdf.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\5cb6229f-69ab-49fb-ab17-4a3e3ef26bdf.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 09049fb4c1dc0a1a6d411c386a6fec9c4acaf12d697c3afd2b72f28cbd71e58e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  settings.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                                                                                                                  • Size 280B
                                                                                                                                                  • SHA256 184ad87ae1ee8c58e7c2d7659eac10981ca90c2cc435b8e6ae6b82fdc60b3118
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  settings.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\settings.dat
                                                                                                                                                  • Size 280B
                                                                                                                                                  • SHA256 415f91cf19043fd8582d06484cfd694f35d7557e9475287f27b8286ea09f9bce
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  throttle_store.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                  • Size 20B
                                                                                                                                                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  temp-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                  • Size 144B
                                                                                                                                                  • SHA256 d52a361f6c1d3ee1904fcb2795f8d84213b3e295b6cdd2551c78e05aad74762e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 48B
                                                                                                                                                  • SHA256 07457656a9ac3547e7b70db2ff0d9664668bd5f04881d4f38c3da8023ec9832d
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  MANIFEST-000001
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                                                                                                                  • Size 41B
                                                                                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  SCT Auditing Pending Reports
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                  • Size 2B
                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  c228ace1-6096-4daa-8207-8b5771852b7e.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Network\c228ace1-6096-4daa-8207-8b5771852b7e.tmp
                                                                                                                                                  • Size 111B
                                                                                                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  CURRENT
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                                                                                                  • Size 16B
                                                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  e56469d6-d3d0-4eda-bd79-45afa02f6029.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Default\e56469d6-d3d0-4eda-bd79-45afa02f6029.tmp
                                                                                                                                                  • Size 6KB
                                                                                                                                                  • SHA256 ea14f469b95cf0c6483d4b286ff1eab47b735daecaa746d6536f8f1ab5fcec81
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  data_0
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_0
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  data_1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_1
                                                                                                                                                  • Size 264KB
                                                                                                                                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  data_2
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_2
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  data_3
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\GrShaderCache\data_3
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\com.aichat.app\EBWebView\Local State
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 01d8724b442be0fcda426ec45ece986567e6afc5d013a65b8b5397d001672dcf
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  file.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\file.txt
                                                                                                                                                  • Size 56B
                                                                                                                                                  • SHA256 3fe11de12729b31ec6cd74678773c3e1052a0d9be6be5ab9f71f4390a65faf31
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  42c878d9faa1a238.customDestinations-ms
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\42c878d9faa1a238.customDestinations-ms
                                                                                                                                                  • Size 23KB
                                                                                                                                                  • SHA256 55b6b89669d5a490c3e94c20e20558e3ef53118750552030c6b6779924689231
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  9COZQ81D5DV35QSSEYMM.temp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9COZQ81D5DV35QSSEYMM.temp
                                                                                                                                                  • Size 23KB
                                                                                                                                                  • SHA256 e819ba89b653f103b7bdc2441937baf5411ae91ae00e77608b714a147f101fd3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  settings.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                                                                                  • Size 40B
                                                                                                                                                  • SHA256 256a52658da9963a07f84eef256cdd55faebdeabcd5b0b96a18a088bb3429c35
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Bookmarks
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks
                                                                                                                                                  • Size 22KB
                                                                                                                                                  • SHA256 bdffebce0d1e121ea774f2bd7422f98c91b1de3de43b21e15a6c918ca9758362
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Bookmarks544c5a88-fecd-4571-940b-aa55ab43c47e.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Bookmarks544c5a88-fecd-4571-940b-aa55ab43c47e.tmp
                                                                                                                                                  • Size 24KB
                                                                                                                                                  • SHA256 edd1489d6899150e914dbbaba5209ef1d9db03496c538a9adf404eff57444225
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index
                                                                                                                                                  • Size 24B
                                                                                                                                                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  temp-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 dfa112ad781ef54923ee43570a86a768f75941833597bcac820267bdda7b4846
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 48B
                                                                                                                                                  • SHA256 4b1897bd98d57967fabadd88f214caae5cb97e41ae6ff21e0f7972ef8af4427d
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  messages.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\_locales\en\messages.json
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 57e2b257a65fa5e980c619214ed9ae25580bbd581143e28abac49928b31977a6
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  background.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\background.js
                                                                                                                                                  • Size 17KB
                                                                                                                                                  • SHA256 c7a162a7650887dffe12034ddbba5ddb91ca5bf4f5478f59ded324f7e088bacb
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  twitch.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch.png
                                                                                                                                                  • Size 677B
                                                                                                                                                  • SHA256 959a810529fcf478d40d02fc418e6223e38bdeba0deae8e83b55028d47bbef6b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  twitch16.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch16.png
                                                                                                                                                  • Size 370B
                                                                                                                                                  • SHA256 6534efc770a8a32c881258029c2f2b9d9f1b75228f53bf9b4cd2b9a9689884e0
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  twitch48.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\icons\twitch48.png
                                                                                                                                                  • Size 921B
                                                                                                                                                  • SHA256 47e37c0726206401cc69cb6ab0fdda79b364356a5e2fdbd5ce479bfbb965f245
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  colors.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\utils\colors.js
                                                                                                                                                  • Size 5KB
                                                                                                                                                  • SHA256 80cc31214c554212050ac62dd04bdb33b012b3b42634ef16f461aca2dc8572fb
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  preferences.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\utils\preferences.js
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 424634b7911f5002d426d9455139bfe578e0a3d8143a4b5f23597ffc22ec0923
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  stats.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\utils\stats.js
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 f2b7e0086a62415550738764edbd98a22ed7524623343b4276951b8cb2207b52
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  twitch_api.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\utils\twitch_api.js
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 db2f7f893c141525ecb33ce344471ef44dd457980f1fe138a91759d556b4a002
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  volume.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\aelmefcddnelhophneodelaokjogeemi\0.31.0_0\utils\volume.js
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 3a30f4a95a4ca688fafa4c5594c039bbba5e5d14187dd1da286e48387d3e3d7e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  main.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.8_0\main.js
                                                                                                                                                  • Size 47KB
                                                                                                                                                  • SHA256 9cc5e1dd96d76735499257c52d632a0a9e17ed4da929035067dadcc586000335
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  scraping-method-Dq4mm50p.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\scraping-method-Dq4mm50p.js
                                                                                                                                                  • Size 6KB
                                                                                                                                                  • SHA256 99c8d4f76ebc9fc6cea115065570a12d41903c93e18c1c6385b5b2e70256eb70
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  service-worker.ts-fle0M1Xd.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\service-worker.ts-fle0M1Xd.js
                                                                                                                                                  • Size 13KB
                                                                                                                                                  • SHA256 4ebb6cb9c3f033302d6a8c31329009082bafeab73c39cca179511b5a972ba8f8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  service-worker-loader.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\service-worker-loader.js
                                                                                                                                                  • Size 49B
                                                                                                                                                  • SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  5428.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\5428.js
                                                                                                                                                  • Size 144KB
                                                                                                                                                  • SHA256 b5174db76402d3cd030aaabfc594000aeceeb929cb16d69191a54451926d7b36
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  blacklist.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\blacklist.js
                                                                                                                                                  • Size 76KB
                                                                                                                                                  • SHA256 69ca9b39d7adb3ef75886f94702fb4fb7ffdd9900b25e20c1383928c4e3cac57
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  common.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\common.js
                                                                                                                                                  • Size 2.1MB
                                                                                                                                                  • SHA256 e55d3c1625d1e3c95549db610b2ade850b9597c3c9e78568406da71ae93393f2
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  favicon_opera_one.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\favicon_opera_one.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 7020bcd4e2443007b9ffd23d100268d114da2768e9c2ab99d0d4fcbafbcfa662
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  reader_mode.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\reader_mode.js
                                                                                                                                                  • Size 112KB
                                                                                                                                                  • SHA256 d6671e14f42d8ca03d84a67f459b392123dfa65ad1fcd0c0ec105981ee2cc1c3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  service_worker.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\service_worker.js
                                                                                                                                                  • Size 92KB
                                                                                                                                                  • SHA256 00c8faf8d845776b2a7cf7402f85b9b0be81396c887f5b0f401d2b485facd742
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  spotify_frame_interceptor.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\spotify_frame_interceptor.js
                                                                                                                                                  • Size 5KB
                                                                                                                                                  • SHA256 71e05e0bba7fa44f282661fc99cc7b824d556dbb32957e027c995b555aae20a5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  vendors.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\jifbgnmbgbdiedhdecealmlgmekpagde\9.68.0.1_0\vendors.js
                                                                                                                                                  • Size 2.1MB
                                                                                                                                                  • SHA256 d4813679fe7795c52a94e30f00011d4cbd6c6fb979b0ce2a994aa45bc2cd8fe4
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  messages.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\_locales\en\messages.json
                                                                                                                                                  • Size 429B
                                                                                                                                                  • SHA256 c6a7161359e3c4fbc4059b7209c585f9aa2306c08e6c39a3003f4b29f2ceb22d
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  background.js
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\background.js
                                                                                                                                                  • Size 87KB
                                                                                                                                                  • SHA256 b199d4f989c63947c53a9d07450038cfe274b7a10e8cc7d688c4049ae14ef63e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  content.js.LICENSE.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\content.js.LICENSE.txt
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Active.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\128\Icon_Light_Active.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 97d9553a4f725354a6d5c3eff11f31285fd89c3b150593f04785b83d0a56efc2
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Available_Red.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\128\Icon_Light_Available_Red.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 9eccebdbdb61efc0cbd8bccf3a5fedc6f9a1ebe5084b160783f90a56cd1efa7b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Available_Yellow.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\128\Icon_Light_Available_Yellow.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 c165ef60bf3806cd0a7121a8d6cfd06909fc84b38a07d43e809bd7bff564099c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Neutral.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\128\Icon_Light_Neutral.png
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Active.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\32\Icon_Light_Active.png
                                                                                                                                                  • Size 883B
                                                                                                                                                  • SHA256 50aa1dcfa9083b57dd6187752b2c149294210be12d263b793d27daf8d431954c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Available_Red.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\32\Icon_Light_Available_Red.png
                                                                                                                                                  • Size 895B
                                                                                                                                                  • SHA256 2278e95b28851ade57217ab5c7b32598c44e1085693a3e26379643d29fa0a6d1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Available_Yellow.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\32\Icon_Light_Available_Yellow.png
                                                                                                                                                  • Size 895B
                                                                                                                                                  • SHA256 726a50a9c008449ab7bafbf21325bfc72093b7ae6a56c5be90cf8c32a8a44641
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Icon_Light_Neutral.png
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\icons\32\Icon_Light_Neutral.png
                                                                                                                                                  • Size 932B
                                                                                                                                                  • SHA256 b8e92f9e9b9dc82799231b8d1b57091a9d0bcdd9b54615f86e8c4e4e5c9f036b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.html
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\index.html
                                                                                                                                                  • Size 222B
                                                                                                                                                  • SHA256 fd21c7ca4637b0221250a14b9fcfb6ebc3b734e659ad80151be4bc579db818f1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  rules.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.21_0\rules.json
                                                                                                                                                  • Size 839B
                                                                                                                                                  • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  MANIFEST-000001
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\IndexedDB\chrome-extension_jifbgnmbgbdiedhdecealmlgmekpagde_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                  • Size 23B
                                                                                                                                                  • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  2cafaa77-58fc-4dbd-864b-9009bad27f08.tmp2d77be7c-b868-44dd-976c-e38e1880fabc.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\2cafaa77-58fc-4dbd-864b-9009bad27f08.tmp2d77be7c-b868-44dd-976c-e38e1880fabc.tmp
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 cc914b6c8be70f233d533244b1fe41e32c495b9bb57901a96777f7d19fd75dfa
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  76fe91cc-40d2-4b22-8d27-149304932da7.tmpbedfd7bd-35de-4fc1-b45d-550d61d889b4.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\76fe91cc-40d2-4b22-8d27-149304932da7.tmpbedfd7bd-35de-4fc1-b45d-550d61d889b4.tmp
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  772a1468-c4fe-4380-a89b-b62c76314fb5.tmpca134388-6e28-4a57-94da-47c4caad1560.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\772a1468-c4fe-4380-a89b-b62c76314fb5.tmpca134388-6e28-4a57-94da-47c4caad1560.tmp
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 353f070543d1c43247d565c23d4c0346a8d65d902aa7bae04c6ae5e64bc5cde7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  95d37310-fac2-4337-9331-4ba4b6d2224b.tmpe57e887f-875f-4ad8-ad21-8d7550e87929.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\95d37310-fac2-4337-9331-4ba4b6d2224b.tmpe57e887f-875f-4ad8-ad21-8d7550e87929.tmp
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 d408d3e1f04ac8df1826c0a19d90a73b777a0562da2b4e1c9747a71b9b7c5ef8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  98321140-6042-4423-888d-7002fc26ecb0.tmp278d8608-9dc2-44ad-8544-7ecbdc29f678.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\98321140-6042-4423-888d-7002fc26ecb0.tmp278d8608-9dc2-44ad-8544-7ecbdc29f678.tmp
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 2f1a860dec73e59307d1a8e1b1ace276076ef77008f468720569bfc8d7ba2512
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  d27fa9d9-388e-464c-9bf7-30133e1a9f78.tmp7d22b8ec-be41-4fa6-aed9-0c8f79fa167d.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\d27fa9d9-388e-464c-9bf7-30133e1a9f78.tmp7d22b8ec-be41-4fa6-aed9-0c8f79fa167d.tmp
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 b79b047aa13202f575c92b513e67530ee9a5de4755d8d67c85c2f156c9a4eb39
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  de7558f3-436d-465a-816f-ca2bc973728c.tmp93ee1250-6c77-490c-8ebc-81f3ef45db96.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Jump List Icons\de7558f3-436d-465a-816f-ca2bc973728c.tmp93ee1250-6c77-490c-8ebc-81f3ef45db96.tmp
                                                                                                                                                  • Size 27KB
                                                                                                                                                  • SHA256 2812a1a85198aa0c3b5170580573935005cbded7ffac283de2da0085f9e83d64
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Network Persistent State5410b67b-ee2c-4080-a152-02f6636e7bdf.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Network\Network Persistent State5410b67b-ee2c-4080-a152-02f6636e7bdf.tmp
                                                                                                                                                  • Size 59B
                                                                                                                                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Opera Custom Icon.ico5960c155-c06b-4d8f-9a0b-9cfbc902eb05.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Opera Custom Icon.ico5960c155-c06b-4d8f-9a0b-9cfbc902eb05.tmp
                                                                                                                                                  • Size 162KB
                                                                                                                                                  • SHA256 5903c920e584fc5f1e918bd641bf58fd56e8cb20bb68269892a4984ea7538621
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 5d679af39f90c00574961e06e43b343e10b655713279b86369b5a78018583158
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences29757c59-292c-4f90-b056-c1d7132e7819.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences29757c59-292c-4f90-b056-c1d7132e7819.tmp
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 7ba811b979357fb74e736431af66e3253cb66b9faddb8ada2a2583cc0645e284
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences7d655307-f696-45e4-b843-b0d599430668.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Preferences7d655307-f696-45e4-b843-b0d599430668.tmp
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 f7d9496e45e3aca3aff062954bf6877d5bc7a43658daac06b20c3df527f6d27c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Secure Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences
                                                                                                                                                  • Size 79KB
                                                                                                                                                  • SHA256 b224dc49134fd7d2f1c537bff509d9de509c40428f5081b61797905c00c0b6be
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Secure Preferences65827d6d-03cc-4052-a54b-ee5ac186b268.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Secure Preferences65827d6d-03cc-4052-a54b-ee5ac186b268.tmp
                                                                                                                                                  • Size 114KB
                                                                                                                                                  • SHA256 0d8cb33220d14600ff13bfe2ef597ea812f7d93e8e72e79e215e42cff112fcef
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  temp-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                                                                                                                  • Size 528B
                                                                                                                                                  • SHA256 eff5055df42fb2881a5c9b8981f0757325e21d0e5aa09195d6e40ed1eaaca5f0
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                  • Size 72B
                                                                                                                                                  • SHA256 659ec8277d72543408ebcd8b23c5614ad28683eb7d28d88f5ad778799ebf6045
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw
                                                                                                                                                  • Size 429B
                                                                                                                                                  • SHA256 6bded97ec9f2b8b6b615f44e3116f45bf61a13f1037ffb620029e4a506712e3a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw0497137d-97f1-42e2-a7e7-e84d6f5cd525.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw0497137d-97f1-42e2-a7e7-e84d6f5cd525.tmp
                                                                                                                                                  • Size 669B
                                                                                                                                                  • SHA256 64e97c3787508b256133284e3e7504d9668783c2e17aa0c5a9a1aeadbda577e1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw05f0f015-850a-4db7-a8bf-04e2b28e5fb5.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw05f0f015-850a-4db7-a8bf-04e2b28e5fb5.tmp
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 1f033b107fd5dd2275c7f1d7ac4ecd12ec5b1d1cd68e85c3ffbd6da7a9cf0f9b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw09d3ccae-d984-472d-9ee8-0320e2760bd7.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw09d3ccae-d984-472d-9ee8-0320e2760bd7.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 548b195f9a735d9a6814b98002330d446893ff1d8bda691a43e87d238d13e5ee
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw155136db-a1a0-40ea-961a-6b2177f025f9.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw155136db-a1a0-40ea-961a-6b2177f025f9.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 59ed014a5b078d962d19d30cc94f1ff67c1c40c5b58ee1410b7b68edec1e0d7f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw16727d79-d1c3-4dff-97dd-fd7d2b0d096c.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw16727d79-d1c3-4dff-97dd-fd7d2b0d096c.tmp
                                                                                                                                                  • Size 541B
                                                                                                                                                  • SHA256 e6709d51ad5ab242a89a3dcff02f3c4c6003ceec10273bb93d9e356f68aa05ef
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw16d1af3a-dc35-4821-99e8-8b414fe61418.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw16d1af3a-dc35-4821-99e8-8b414fe61418.tmp
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 8a94f7e75eeb677c3700601bf110d659e25f0deb9afbfd1798c568a76b5ab52e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw17884359-3aa3-48ed-a242-c2117b884bba.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw17884359-3aa3-48ed-a242-c2117b884bba.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 cf1ce3326a130f2b7fe72f277c14286d8dc7d9deb0ed9a20ae03da2dbd0c9f2b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw17cf46a0-df3c-4380-891d-0bbb4bd73909.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw17cf46a0-df3c-4380-891d-0bbb4bd73909.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 72245ce3ddb4f208291ed174e46d42896247aab7724a24beab24197c715640a5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw1c52bdb8-aae1-4518-a02c-09cca61adc8a.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw1c52bdb8-aae1-4518-a02c-09cca61adc8a.tmp
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 166797b7dbf949597fd5e6f408e4eca6a9c64c74199597f897d09a9746fa8c71
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw203537d6-8bc0-42ad-85f6-95b377f77dbf.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw203537d6-8bc0-42ad-85f6-95b377f77dbf.tmp
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 d4cf9bac7256d2191288d45545647531bec7617df927fbc0c069c0c874f9c086
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw384013ee-7ba2-4e10-b127-50ffe849949d.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw384013ee-7ba2-4e10-b127-50ffe849949d.tmp
                                                                                                                                                  • Size 7KB
                                                                                                                                                  • SHA256 30fdae2828f164a669c8a4a7ded15afb54c3a38d9b82881578acdcfb643e04e5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw39217887-725d-49d5-99ae-1eede03b1dff.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw39217887-725d-49d5-99ae-1eede03b1dff.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 35399d87a3b845d140a9268e4475baef6bc4db88dfe83a4b31bcb6bd2ce997ad
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw438d6b54-8e83-4d36-9064-9c4be87589b3.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw438d6b54-8e83-4d36-9064-9c4be87589b3.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 da4527d4a08bf20a6dfd02d10232121f7501b5390f053583de0b7fa03a81642a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw5310c2ec-d160-4b2e-a090-3a22abf0cc23.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw5310c2ec-d160-4b2e-a090-3a22abf0cc23.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 c474d4f5d1298e58b75ade4ae8af13daab5b4eb2b8d83fc68746daa565fa93bc
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw559471f4-22f4-418f-adcd-c7e413a819ed.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw559471f4-22f4-418f-adcd-c7e413a819ed.tmp
                                                                                                                                                  • Size 973B
                                                                                                                                                  • SHA256 95c4cb7a189c45fff1c73997641c36d0c9217e6cc17421ef056b7b6c58d42b5e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw5b3c2092-278b-47c0-8535-3cd674fc7fb0.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw5b3c2092-278b-47c0-8535-3cd674fc7fb0.tmp
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 e3cb7c6d0c5df5e2a1d4b03452f6f763c1d77ef4f81bd392b6bdfffbbfed46be
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw661ef070-de79-481f-96bd-e0f1925094ea.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw661ef070-de79-481f-96bd-e0f1925094ea.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 a7a497c920050dafd06f205934a3630653d9048585f6923dd08ae009d2495917
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw6723e9b3-6db7-41bb-a6d4-8249d1e068a8.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw6723e9b3-6db7-41bb-a6d4-8249d1e068a8.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 98d023af3771a3efb1c75a49c8ca1533ec4242a749ec9ade60f858dd6683030b
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw68aae0f3-5acd-4606-a191-688dbbd0fcf2.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw68aae0f3-5acd-4606-a191-688dbbd0fcf2.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 f6e3ca819d3efeb3e333b7d4d12cd6a2d71437e3e1b250158d9e760f0372a562
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw6a5916e4-c932-4578-95c3-a71e3f5056c4.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw6a5916e4-c932-4578-95c3-a71e3f5056c4.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 11e30067495a29ba9c29ca1266138f94e22a5413e6ae0ac132a31f04d20556d8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw6e232c2b-5778-47ea-8c1a-5458254cf3e4.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw6e232c2b-5778-47ea-8c1a-5458254cf3e4.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 2603452544bbec3448e2402f620d1d5995d0316007d8924d5c08725cc6fb56b9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw744f955f-cddf-4e44-b341-5f44f87cf242.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw744f955f-cddf-4e44-b341-5f44f87cf242.tmp
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 1f89fdb21075a129e5249a61a08024b8e11e4e2611b60110a8c9c12ba0e3668a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw76c6f903-d718-4e29-bbdb-ea9a27791693.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw76c6f903-d718-4e29-bbdb-ea9a27791693.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 3b17c5671110c65292cac3d3970e60499778803c9f7c3862f63226833e7ae1a5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw800b7cdf-7be3-42d7-b576-fdb238d10007.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw800b7cdf-7be3-42d7-b576-fdb238d10007.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 432c6711448ba25111d7547b155c16399ccb67d84508170580dd24a437293493
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw8250a017-5ced-4239-9ce0-36da1a0ae84a.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw8250a017-5ced-4239-9ce0-36da1a0ae84a.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 a43500de450b31a3b0998b1a2543937e0d8dce908a0edd9c43cdf7cadfc64b4e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw8ad09ef7-df27-4c02-805c-e7ad98ba22b7.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw8ad09ef7-df27-4c02-805c-e7ad98ba22b7.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 81723ea1be1a1d005988485aec0929e2eac28af096659df38d653c16c86a8f22
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw8f52dfc9-6b4e-4be7-b1af-147854371b71.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw8f52dfc9-6b4e-4be7-b1af-147854371b71.tmp
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 512f9d80b20805fcbecfbcfcfdeb0d8d1956b84eb70757735bbce39597f97c6c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw974ec159-9449-4260-87c7-bf6c51879c40.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw974ec159-9449-4260-87c7-bf6c51879c40.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 4539533e2851c9af135cd7828f4f0fea5671850c1d5db2610c79de4d3cf63a2c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw9b99fe9d-194f-4c8c-afbe-1cee78bbe23a.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw9b99fe9d-194f-4c8c-afbe-1cee78bbe23a.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 318490902dad147ae6f5685225a2a9be7ce1f2ac0c3baf717bc20bf0a160a3d9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw9d64bdee-f6c4-4ff8-b42e-59f1ca886640.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.raw9d64bdee-f6c4-4ff8-b42e-59f1ca886640.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 b8d5b76a5bedeadfd1e0c04f42cdd6df5b3919f857a950db25d96a568899a770
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawa377b1e0-f98f-4be4-b879-a03cf4291959.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawa377b1e0-f98f-4be4-b879-a03cf4291959.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 3764f254971b987cfe77679cc8051eab45e62629d87cebe1eb48b135a7f83a03
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawa77c17e0-b57f-4bdf-98e5-441900128fbf.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawa77c17e0-b57f-4bdf-98e5-441900128fbf.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 18d8925a3bb1b97475d2eb0fb92b0860735f7f96606546bd24e2269d03a44f36
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawa7f726b8-fee6-4e2d-b527-d644614854ff.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawa7f726b8-fee6-4e2d-b527-d644614854ff.tmp
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 017c481fc79cfd78cf08aa6b2504394bcf90270f5ad61e7d8ca6ef8799c399ad
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb224a6c7-cbc7-4b09-b3ae-00dd5b143183.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb224a6c7-cbc7-4b09-b3ae-00dd5b143183.tmp
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 789d2d64a24c655b24edb2ae5d7cc89f8ee36c2e304e7e0de02e54597344f4f3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb8e91147-cc05-4700-8377-84cb22d61244.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb8e91147-cc05-4700-8377-84cb22d61244.tmp
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 b458e92b91bb06d4fae465f11318d74ef4c7a81760ec3234515ecd8ac6b93da7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb922d3ac-0c59-48cd-acd9-0f8ce124b096.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb922d3ac-0c59-48cd-acd9-0f8ce124b096.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 1af703409d11b5d9382331551d86f4de9847c4c60672733cb9748ed28c903f19
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb945f5c9-828d-49e5-8d59-debeea938bc1.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawb945f5c9-828d-49e5-8d59-debeea938bc1.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 aa6c1c5a6adaa6183f3e13d9eeee74075e881b27643c892381cda7bc22b4bfb5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawbf4a9fe3-59c7-45b6-9e80-ac990bfbaada.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawbf4a9fe3-59c7-45b6-9e80-ac990bfbaada.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 894f8321956bc2734dc170a2906fb073096a09c2f0ef0898a215dc5ba6bde6d7
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawce49f19a-7db2-4b96-9ef5-a8779c2219fd.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawce49f19a-7db2-4b96-9ef5-a8779c2219fd.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 b6261fd3302456df5a882316bf8045e52458f972af0d5ee61b6d14509a0fd926
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawd668b52b-2c50-4923-b151-998ab8a4903c.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawd668b52b-2c50-4923-b151-998ab8a4903c.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 1bce6eb2b1d5182514ed3a281431ec5fcd86e81f5c80f4c471fab8809a34842b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawdc0e2836-494f-4cfd-9483-e2878f9d0e6b.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawdc0e2836-494f-4cfd-9483-e2878f9d0e6b.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 088107f95c201002aa3affcb131051215981057b420e8a228d5143967797da5a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawe9d06d5c-e2a0-4661-8cc8-14c89a48ae03.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawe9d06d5c-e2a0-4661-8cc8-14c89a48ae03.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 3f605af2e85f8cc847a022fa362c78275588b526f6edbc9504fcdada32f37467
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawebceb457-e39e-46fb-a707-e57f15936a7c.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawebceb457-e39e-46fb-a707-e57f15936a7c.tmp
                                                                                                                                                  • Size 7KB
                                                                                                                                                  • SHA256 46d4b8a67597fe2f1c3c98a85af47cd90d2bad623b421ed0ddc99b3f608c0a14
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawed577c69-f032-44f0-abd4-31a8e73fcd67.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawed577c69-f032-44f0-abd4-31a8e73fcd67.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 5d8399dca6bac2a471368a8cc9abc25021fca4c69a463888772225e274f9b097
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawf3cb3769-9791-4420-a98a-495b1d2a3121.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawf3cb3769-9791-4420-a98a-495b1d2a3121.tmp
                                                                                                                                                  • Size 781B
                                                                                                                                                  • SHA256 1509c1d333ad1223afdc072f65e057c819171d66a090270e2f4a6504e24bebfe
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawf3f978fe-8fc9-4698-be6b-f6a2a27c8db3.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawf3f978fe-8fc9-4698-be6b-f6a2a27c8db3.tmp
                                                                                                                                                  • Size 10KB
                                                                                                                                                  • SHA256 9e1af9e1f2f04aabe6fe24ba0bcf222047f2916e90e6519b9a212478bff150b3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawf8c50797-d6ed-437c-9f3e-c7a43baedc45.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawf8c50797-d6ed-437c-9f3e-c7a43baedc45.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 ee59fca6c0cc6e783b6ec58ab01c2c98574e8c011f6b98b1cfcb33d213c72814
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawff55e4f1-0567-4ac1-ad92-25bdf1d8f67b.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\StatsSessions\session_1cc609b4-d6ae-4e32-bc6b-5e65b4f3b5f9.rawff55e4f1-0567-4ac1-ad92-25bdf1d8f67b.tmp
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 af0cdfa11cbaa5cc4cbb08c51fa606f4894366a12532ecc099f06983ccbdef9a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  daily_wallpapers.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\daily_wallpapers.json
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 7fdd2937785f48c5518e4cccf5027096f1378046a5cb4e7443819cd6bd2f398b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  rhs.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\rhs.dat
                                                                                                                                                  • Size 107KB
                                                                                                                                                  • SHA256 d6e199b269c1a040ff9d9b2055ccb3b673b2d1525e447d3ac441ad188830de84
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  spotlight_campaigns.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\spotlight_campaigns.json
                                                                                                                                                  • Size 543B
                                                                                                                                                  • SHA256 82df18b1c171623b7c60e2a7a6f5c49147bf2fe3c83fb06482f6aeca07f87037
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.1442156427
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.1442156427
                                                                                                                                                  • Size 327B
                                                                                                                                                  • SHA256 ef8a422b5fdcfb7d0914be01eb2fec96107a8e25a78743fc6d3aee0112c1048a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.144215642704a00094-4c21-4593-a814-a27e4a3cc6f9.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.144215642704a00094-4c21-4593-a814-a27e4a3cc6f9.tmp
                                                                                                                                                  • Size 396B
                                                                                                                                                  • SHA256 1487c1cd58e699ba5626a76ad075e5c4cde7e59effdb37699494f0b8d793989c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.144215642704bd1e23-4b2d-46f7-8642-ef143fdec3d0.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.144215642704bd1e23-4b2d-46f7-8642-ef143fdec3d0.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 dae55330c36dc0ec8201de3865cc9b94220a43ebaf6a5110970cc7108e159a2e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.14421564273e43fb15-9bad-4afb-a0a1-178cfed9991c.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.14421564273e43fb15-9bad-4afb-a0a1-178cfed9991c.tmp
                                                                                                                                                  • Size 557B
                                                                                                                                                  • SHA256 e09463d8548b3916c3614b008f467a2d142fa1a4123523bb7729eb6d15139740
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.1442156427409b0b13-8430-482e-867b-12fc99d5c17b.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.1442156427409b0b13-8430-482e-867b-12fc99d5c17b.tmp
                                                                                                                                                  • Size 494B
                                                                                                                                                  • SHA256 7f906545dd4ed872d056f71860113e2f23b4851f2150a740b096b01bee8f39d3
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.1442156427528d12f6-c338-4394-b1fe-38011c462192.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.1442156427528d12f6-c338-4394-b1fe-38011c462192.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 517252e619d25e29b7c4743dbe8103756e758e8377edd8ad444724a4e21ddb1f
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.14421564275d3b80a6-ff82-4a44-a8bd-d0c8a022f7f3.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.14421564275d3b80a6-ff82-4a44-a8bd-d0c8a022f7f3.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 8bec7e3a4f055e5393dfa5c2ee6222b7c246b9703985a5909a6a44e37f280fae
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.14421564276314719d-f0a4-4818-939a-9197a9083eb8.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.14421564276314719d-f0a4-4818-939a-9197a9083eb8.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 416e8e5d1be3912438f80c84f4da2be93ebe049827cc67018f74b397febc744a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.14421564277a968fe5-212f-4b66-af32-91450cadebfa.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.14421564277a968fe5-212f-4b66-af32-91450cadebfa.tmp
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 1192ba51d21c934b2ea5d14db753cd598c68de8e1d99d6d2dc04a9806ed49f74
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.14421564278cd9727c-5390-40f3-a874-93fcb864af5c.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.14421564278cd9727c-5390-40f3-a874-93fcb864af5c.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 c0aed291562e5e5e5da63cc75ea20a761df7f2e67597082eb427c44206def9b8
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.1442156427ac97ed6c-7811-4169-9cb5-e613f2405329.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.1442156427ac97ed6c-7811-4169-9cb5-e613f2405329.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 83503c7eec6f206b807737f2508d82fe059acec0522b8d27c51e6be698278c58
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.1442156427b56731ea-1368-42dd-a881-d9cb553270c4.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.1442156427b56731ea-1368-42dd-a881-d9cb553270c4.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 5a77852a9a975c97b371beebd71aa0c58350e05a8132030c2010615dffd5a2ca
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.0.1442156427e4d2cd2b-406d-4c66-8b46-2e06d399a4a0.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.0.1442156427e4d2cd2b-406d-4c66-8b46-2e06d399a4a0.tmp
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 cf0bddcc44b3cdd7c9d992e974f55194ffaa26721987275e9dc9cddedb3f213e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.1.602941019
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.1.602941019
                                                                                                                                                  • Size 171B
                                                                                                                                                  • SHA256 d007ae50e69648b9f62539783ad5b7feae787f2926e6829066c931ebf6926c67
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.1.6029410192c6b171f-a898-49b3-9f02-ca24f7989f43.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.1.6029410192c6b171f-a898-49b3-9f02-ca24f7989f43.tmp
                                                                                                                                                  • Size 261B
                                                                                                                                                  • SHA256 879f6484bf5fd134b0e1dbb3fa87aaaf5d0ea74475a903463920f119b2a7a2ce
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.1.6029410195b2fb983-b5a2-4c3b-bdd4-b7b1f7a57afd.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.1.6029410195b2fb983-b5a2-4c3b-bdd4-b7b1f7a57afd.tmp
                                                                                                                                                  • Size 261B
                                                                                                                                                  • SHA256 0ad1bddf8ff044783a4e07f5fa3fa600e9800ec2f66acd9f17067b3dc29b40eb
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.1.6029410199b11474b-e8d4-43bb-9b8a-9a7ca3e52f3a.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.1.6029410199b11474b-e8d4-43bb-9b8a-9a7ca3e52f3a.tmp
                                                                                                                                                  • Size 261B
                                                                                                                                                  • SHA256 3f3b04d6ce487ade0419758340c5651ade6a10fcc9837cc41a575233f2fbd266
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.1.602941019ba1294e1-3bfd-4c49-ad6b-907801b68cec.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.1.602941019ba1294e1-3bfd-4c49-ad6b-907801b68cec.tmp
                                                                                                                                                  • Size 261B
                                                                                                                                                  • SHA256 80fee43bde47110a63079183ec6d36f749b245fe43ad21c08a7625d7aca14cfe
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  ssdfp2036.1.602941019fd937bb3-5387-4d0c-8fb8-a21f1dbb27b5.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\ssdfp2036.1.602941019fd937bb3-5387-4d0c-8fb8-a21f1dbb27b5.tmp
                                                                                                                                                  • Size 200B
                                                                                                                                                  • SHA256 861984de441699f7219944f977e125b13535b8ea4f1e7b5ae8757f46066f7fca
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  suggestions_cache.json3bb92edc-1553-42cd-8b28-8c1a43a43db4.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\suggestions_cache.json3bb92edc-1553-42cd-8b28-8c1a43a43db4.tmp
                                                                                                                                                  • Size 795KB
                                                                                                                                                  • SHA256 8abe942a6143e11c7aff45bafd655bfab81fa83e537f69f0e567e9c392c849e3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Local State
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 d583abb77326ebe18d0f0f6ebd8cce028dad105b21c48c44fe620bc8aef20fc9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  VariationsSeedV2a362ec4f-1bbb-474f-9aa2-4b4bfc517ef4.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2a362ec4f-1bbb-474f-9aa2-4b4bfc517ef4.tmp
                                                                                                                                                  • Size 19B
                                                                                                                                                  • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  VariationsSeedV2b965bb89-baf7-459e-9e2e-9323f64b05f0.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\VariationsSeedV2b965bb89-baf7-459e-9e2e-9323f64b05f0.tmp
                                                                                                                                                  • Size 11B
                                                                                                                                                  • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  clipboard_injection_guard_rules.json
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\clipboard_injection_guard_rules.json
                                                                                                                                                  • Size 6KB
                                                                                                                                                  • SHA256 b8d84b82da3d90323de6cf1b4e3594bf7acb99101c72379b10f4b982f82bd487
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  metadata.jsonb160323e-5245-4524-ad03-db763f3acc9b.tmp
                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\extensions_crx_cache\metadata.jsonb160323e-5245-4524-ad03-db763f3acc9b.tmp
                                                                                                                                                  • Size 13B
                                                                                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  manifest.json
                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_269931914\manifest.json
                                                                                                                                                  • Size 43B
                                                                                                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/1368-3450-0x00007FFF5FB80000-0x00007FFF5FBF4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1368-3449-0x00007FFF58720000-0x00007FFF58846000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1368-3447-0x00007FFF5E8D0000-0x00007FFF5EC71000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1368-3446-0x00007FFF5F830000-0x00007FFF5F8F7000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1368-3448-0x00007FFF60000000-0x00007FFF606F6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1368-3451-0x00007FFF4AA40000-0x00007FFF4ACC3000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1368-3453-0x00007FFF5D310000-0x00007FFF5D358000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1368-3452-0x00007FFF5D570000-0x00007FFF5D5D8000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2008-298-0x00007FFF5F900000-0x00007FFF5F901000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2036-3437-0x00007FFF5E8D0000-0x00007FFF5EC71000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2036-3597-0x00007FFF5E8D0000-0x00007FFF5EC71000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2036-3440-0x00007FFF4AA40000-0x00007FFF4ACC3000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2036-3438-0x00007FFF5C090000-0x00007FFF5C8BA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2036-3439-0x00007FFF58720000-0x00007FFF58846000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2036-3436-0x00007FFF5F830000-0x00007FFF5F8F7000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1590-0x00007FFF58720000-0x00007FFF58846000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1592-0x00007FFF60000000-0x00007FFF606F6000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1584-0x00007FFF5F830000-0x00007FFF5F8F7000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1587-0x00007FFF5FB80000-0x00007FFF5FBF4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1585-0x00007FFF5E8D0000-0x00007FFF5EC71000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1591-0x00007FFF5D310000-0x00007FFF5D358000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1588-0x00007FFF4AA40000-0x00007FFF4ACC3000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2044-1589-0x00007FFF5D570000-0x00007FFF5D5D8000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2448-103-0x000001DEAFAA0000-0x000001DEAFBCF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2448-100-0x000001DEAFBE0000-0x000001DEAFBEA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2448-98-0x000001DEAFE00000-0x000001DEAFE1E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2448-101-0x000001DEB0050000-0x000001DEB006E000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2448-86-0x000001DEAF9F0000-0x000001DEAFA12000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2448-99-0x000001DEAFE20000-0x000001DEAFED2000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3478-0x00007FFF58720000-0x00007FFF58846000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3477-0x00007FFF5FB80000-0x00007FFF5FBF4000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3473-0x00007FFF5E8D0000-0x00007FFF5EC71000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3474-0x00007FFF4AA40000-0x00007FFF4ACC3000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3526-0x00007FFF5C090000-0x00007FFF5C8BA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3476-0x00007FFF5C090000-0x00007FFF5C8BA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3472-0x00007FFF5F830000-0x00007FFF5F8F7000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3475-0x00007FFF5D310000-0x00007FFF5D358000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3564-3479-0x00007FFF5D570000-0x00007FFF5D5D8000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5128-390-0x00007FFF5F900000-0x00007FFF5F901000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5516-825-0x00007FFF5FC90000-0x00007FFF5FC91000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5516-826-0x00007FFF5FEF0000-0x00007FFF5FEF1000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6796-3574-0x00007FFF5FEF0000-0x00007FFF5FEF1000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6796-3575-0x00007FFF5FC90000-0x00007FFF5FC91000-memory.dmp
                                                                                                                                                  Download