Overview

overview

8

Static

static

8

OperaInstaller.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/10/2026, 16:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OperaInstaller.exe
  • Size 178KB
  • Sample261022-tmlzdsssey
  • SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Users\Admin\AppData\Local\Temp\OpInst.exe
      "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=ZDA0MWViYjAxZWE1MTIwM2U4ZDliY2ZlN2Q3OWViYzZhZTk4ZmJjMTcyNjViMTUwZDZiNjMxOWMxZDI0ODU0Mzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJ0aW1lc3RhbXAiOiIxNzkyNjg1NDU1LjA2NjAiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoidmlkZW8tc3RyZWFtaW5nIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJ3cmsifSwidXVpZCI6IjI1M2Q4YzY5LWEwYWItNDdlNC1hMzI3LTEyYTMyYzYxZWFhNyJ9
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Enumerates connected drives
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff664dad2d8,0x7ff664dad2e8,0x7ff664dad2f8
          4⤵
          • Executes dropped EXE
          PID:1636
        • C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\installer.exe" --version
          4⤵
          • Executes dropped EXE
          PID:5836
        • C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2672 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_20261022171056" --session-guid=117f10d6-e533-41ec-b9f0-73a1e6b85709 --server-tracking-blob="NDkwNDU1ZDg3ODMxY2YyM2VjNzY3Yzc3YzBjMGJlN2I4MjQxNDkxM2EzMjQwZjI5MTcwMGE0YjBjMjBlZWZhMjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTI2ODU0NTUuMDY2MCIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJ2aWRlby1zdHJlYW1pbmciLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMjUzZDhjNjktYTBhYi00N2U0LWEzMjctMTJhMzJjNjFlYWE3In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=D008000000000000
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Suspicious use of WriteProcessMemory
          PID:1096
          • C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff664dad2d8,0x7ff664dad2e8,0x7ff664dad2f8
            5⤵
            • Executes dropped EXE
            PID:1860
          • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\installer.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\installer.exe" --backend --initial-pid=2672 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561" --session-guid=117f10d6-e533-41ec-b9f0-73a1e6b85709 --server-tracking-blob="NDkwNDU1ZDg3ODMxY2YyM2VjNzY3Yzc3YzBjMGJlN2I4MjQxNDkxM2EzMjQwZjI5MTcwMGE0YjBjMjBlZWZhMjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTI2ODU0NTUuMDY2MCIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJ2aWRlby1zdHJlYW1pbmciLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMjUzZDhjNjktYTBhYi00N2U0LWEzMjctMTJhMzJjNjFlYWE3In0= " --silent --desktopshortcut=1 --install-subfolder=138.0.6044.24
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5840
            • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\installer.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x2b4,0x2b8,0x2bc,0x288,0x2c0,0x7ff6fa8bd2d8,0x7ff6fa8bd2e8,0x7ff6fa8bd2f8
              6⤵
              • Executes dropped EXE
              PID:2052
            • C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes a Windows system DLL name to a user directory
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of WriteProcessMemory
              PID:3756
              • C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x54c9cc,0x54c9d8,0x54c9e4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:832
              • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:5516
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x94c9cc,0x94c9d8,0x94c9e4
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5344
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2996
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:760
                    • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                      10⤵
                      • Executes dropped EXE
                      PID:2076
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:716
                    • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                      10⤵
                      • Executes dropped EXE
                      PID:1776
                  • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x14b7324,0x14b7330,0x14b733c
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:724
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:620
                      • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                        11⤵
                        • Executes dropped EXE
                        PID:1676
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:5508
                      • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                        11⤵
                        • Executes dropped EXE
                        PID:5728
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:5004
                      • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                        11⤵
                        • Executes dropped EXE
                        PID:1872
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\de932af914ba00303d4a2778a383ac9c831101e2.crx"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5208
              • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x274,0x278,0x27c,0x23c,0x280,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                7⤵
                • Executes dropped EXE
                PID:5960
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1956,i,3631833662256948717,6592402406657622830,524288 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2256 /prefetch:11
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                PID:5900
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1712,i,7727149184831427770,7667414934978365283,262144 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2132 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5128
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2548,i,7117912067855169843,112077094825236335,524288 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2564 /prefetch:13
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5584
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3648,i,16675796549021847580,17111314016892326623,1572864 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3684 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:1848
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4340,i,8653170078615079376,12819818678936930402,524288 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3668 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5856
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4516,i,14868654389471075984,10453701302448474948,1572864 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4572 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5264
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3632,i,13839115532288035405,17160334564910753815,524288 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4312 /prefetch:12
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6088
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3616,i,14241382458487362887,7292239669283345710,524288 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4944 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:824
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5116,i,7790400484801745304,11806974612779230021,524288 --field-trial-handle=2136,i,16824916891782357678,4150075140425631972,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2140,i,10716690497084500460,8886721419528737982,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4936 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:6828
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:6944
              • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                7⤵
                • Executes dropped EXE
                PID:7160
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1704,i,8902285124409132036,13787055839511191281,262144 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2020 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:7136
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2128,i,1274492283646934626,11964670988788990052,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2208 /prefetch:11
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                • Enumerates system info in registry
                PID:6268
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2456,i,2585676416275753636,1884787605444842535,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2752 /prefetch:13
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:7220
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3124,i,9300140842473744270,4901844555074861255,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3248 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:7248
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3148,i,15858666241785384565,7723378275561424895,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3272 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:4368
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3172,i,5515373594800577603,12683986017011106444,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3316 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:7312
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3184,i,10186364326566862149,8666629455579907764,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3336 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:7320
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3208,i,15134968099221069860,4902285730876149337,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3376 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:7344
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3516,i,3902013261561203717,4381432522044334840,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3552 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:7340
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3160,i,574653939009914808,8244435972229685331,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3296 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:7308
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3196,i,4057405636122586697,8190412201464833129,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3356 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:7328
              • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_gx_splash.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C96
                7⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:7844
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4796,i,6358839524204997708,8000327666319015155,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4808 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:8000
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4964,i,11407461672516854484,3162576623495541372,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4976 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:8012
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5252,i,13759822363180614050,1901819768606708573,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5268 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:8048
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5396,i,10625426070763305070,4916066472325722909,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5692 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:8104
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6012,i,18322985436491576018,16109057802002310186,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6456 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:8148
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6900,i,16940441840333829994,14707419823552202467,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7048 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6688
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6980,i,15155944940946673109,7329802647552128027,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7024 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6228
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6904,i,7058260571831526227,9888658677844821607,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6924 /prefetch:12
                7⤵
                • Executes dropped EXE
                PID:2988
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6968,i,8786718679544976312,5149313054419060766,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7316 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:2164
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2356,i,6079919992892431075,2067328463475892989,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7336 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:4860
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7300,i,6258712071717324204,7710087475077642657,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7356 /prefetch:14
                7⤵
                • Enumerates system info in registry
                PID:4572
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7392,i,9311494617368384922,2844339460320948972,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7672 /prefetch:14
                7⤵
                  PID:2100
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7716,i,3087336574289463964,7875421706950209575,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7724 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:1768
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7768,i,13025214851622963103,2823173684006496413,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7968 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:3124
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7972,i,12364307357550687747,14389845593265593808,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8128 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:2656
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8248,i,12525398476223091751,10850897060129034870,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8260 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:4508
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8268,i,16911523835447057696,3211420995581841210,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8296 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:3864
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8284,i,12788994371841858828,16444465355307097459,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8304 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:2468
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8712,i,14908851953167431003,6067489485025645598,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8744 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:1004
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8688,i,15575847237037612866,17599440923796332744,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8784 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:4604
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8804,i,15755720290979298870,10568955531339707607,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8840 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:4852
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8708,i,14320396888497610958,11438118959247897740,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8764 /prefetch:14
                  7⤵
                    PID:5704
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8820,i,9057103805714393316,1175775236167230366,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=8864 /prefetch:14
                    7⤵
                      PID:2420
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8700,i,53272833251209443,11076633255538560343,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8808 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:3744
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9588,i,1591878372817070557,5786696943812609869,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9636 /prefetch:1
                      7⤵
                        PID:7572
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=9828,i,12430950336945223200,4071859350208302155,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9872 /prefetch:9
                        7⤵
                        • Enumerates system info in registry
                        PID:7964
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10116,i,7878464448997772375,888214013379193093,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=7072 /prefetch:14
                        7⤵
                        • Enumerates system info in registry
                        PID:6744
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9764,i,16528653607947434345,1501305236540920031,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10192 /prefetch:14
                        7⤵
                        • Enumerates system info in registry
                        PID:6352
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10324,i,423524492071643911,14899929399974412707,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10336 /prefetch:14
                        7⤵
                          PID:3304
                        • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
                          7⤵
                          • Reads the TCP/IP host and domain name from the registry
                          PID:8564
                          • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                            C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff65de43df8,0x7ff65de43e08,0x7ff65de43e18
                            8⤵
                              PID:8664
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10836,i,9681069969220650669,7569515701547205359,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10368 /prefetch:14
                            7⤵
                            • Enumerates system info in registry
                            PID:8916
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=10932,i,15493846826736326615,12920222315766669005,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10984 /prefetch:1
                            7⤵
                            • Enumerates system info in registry
                            PID:9052
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11228,i,10318710682570263570,3020870883513050068,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11236 /prefetch:14
                            7⤵
                            • Enumerates system info in registry
                            PID:6488
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11384,i,6873624581710755903,4106961048271938711,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11396 /prefetch:14
                            7⤵
                            • Enumerates system info in registry
                            PID:6932
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11408,i,8929206769708713355,14040250927914065132,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=11396 /prefetch:14
                            7⤵
                              PID:7732
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11484,i,13537382564771128207,8524484265889414716,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=3500 /prefetch:14
                              7⤵
                                PID:5532
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10968,i,14084818641711524624,7826945442654367494,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11468 /prefetch:14
                                7⤵
                                • Enumerates system info in registry
                                PID:5388
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8424,i,18184812859294707163,18413230570506560720,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=10304 /prefetch:9
                                7⤵
                                • Enumerates system info in registry
                                PID:8256
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10768,i,15077794112884388987,12896901351711204211,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=8336 /prefetch:14
                                7⤵
                                • Enumerates system info in registry
                                PID:6568
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10180,i,17817367013778139240,1366871870339095490,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=8224 /prefetch:14
                                7⤵
                                  PID:8484
                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6080,i,1748440061952866159,13745138270056758606,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=6072 /prefetch:9
                                  7⤵
                                  • Enumerates system info in registry
                                  PID:8600
                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10312,i,5938089836125086261,4925626922552395264,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=10320 /prefetch:14
                                  7⤵
                                    PID:8828
                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7992,i,15352527763333280622,10561134784653844750,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=8228 /prefetch:14
                                    7⤵
                                      PID:8860
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5552,i,16308803154001370414,11615237282296774449,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=5620 /prefetch:14
                                      7⤵
                                      • Enumerates system info in registry
                                      PID:9168
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7308,i,8256396282604368579,12539619511850202522,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=6056 /prefetch:9
                                      7⤵
                                        PID:1172
                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=10784,i,6724356893747029629,2505241502078290867,1572864 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=9128 /prefetch:9
                                        7⤵
                                          PID:4672
                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11384,i,7000166214250145751,17762595349005839207,524288 --field-trial-handle=2024,i,9994427407092709574,17470854980454107998,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2028,i,489676396781426126,2186123932809273379,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=10836 /prefetch:14
                                          7⤵
                                          • Enumerates system info in registry
                                          PID:8216
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Writes a Windows system DLL name to a user directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4860
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe" --version
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Enumerates system info in registry
                                    • Suspicious use of WriteProcessMemory
                                    PID:4456
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x54c9cc,0x54c9d8,0x54c9e4
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:2564
                            • C:\Windows\system32\wbem\unsecapp.exe
                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                              1⤵
                                PID:1688
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Enumerates system info in registry
                                • Suspicious use of WriteProcessMemory
                                PID:5152
                                • C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe
                                  C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ff963ec68a0,0x7ff963ec68b0,0x7ff963ec68c0
                                  2⤵
                                  • Executes dropped EXE
                                  PID:856
                              • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC1
                                1⤵
                                • Reads the TCP/IP host and domain name from the registry
                                PID:8572
                                • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                  C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=138.0.6044.24 --initial-client-data=0x294,0x298,0x29c,0x22c,0x2a0,0x7ff65de43df8,0x7ff65de43e08,0x7ff65de43e18
                                  2⤵
                                    PID:9140
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                    2⤵
                                      PID:6388

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Hijack Execution Flow

                                        1
                                        T1574

                                        DLL Search Order Hijacking

                                        1
                                        T1574.001

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Hijack Execution Flow

                                        1
                                        T1574

                                        DLL Search Order Hijacking

                                        1
                                        T1574.001

                                        Defense Evasion

                                        Hijack Execution Flow

                                        1
                                        T1574

                                        DLL Search Order Hijacking

                                        1
                                        T1574.001

                                        Masquerading

                                        1
                                        T1036

                                        Match Legitimate Name or Location

                                        1
                                        T1036.005

                                        Modify Registry

                                        2
                                        T1112

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Peripheral Device Discovery

                                        1
                                        T1120

                                        Query Registry

                                        5
                                        T1012

                                        System Information Discovery

                                        4
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        System Network Configuration Discovery

                                        1
                                        T1016

                                        System Time Discovery

                                        1
                                        T1124

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Size 471B
                                        • SHA256 ecbd4b1e8062beb7169a0a9588fe5ac5e6bb4628040aae8ba91eba57a6cdcb2c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                        • Size 416B
                                        • SHA256 d3706770a0c2b2991a8709e825f6fed821c80cba3d3453db9b0b7d11ae7c2514
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        snapshot-new.baf
                                        • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\Cache\No_Vary_Search\snapshot-new.baf
                                        • Size 20B
                                        • SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        f_000001
                                        • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\f_000001
                                        • Size 163KB
                                        • SHA256 8ee37682bb747c7b4d6599910d173b27d458bab1fcda59692fcfaccfae6df349
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        138.0.6044.24.manifest
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\138.0.6044.24.manifest
                                        • Size 225B
                                        • SHA256 a308596d8f06659398ed38592a261ccd03ec12525ffddc8208120ebe5517abb8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-100.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-100.png
                                        • Size 1KB
                                        • SHA256 56bcd46dcfae3147a8b8b3d00ee5041dad4655e83a7e829bf637377c96538643
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-100_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-100_contrast-white.png
                                        • Size 1KB
                                        • SHA256 3829dbefe8bd528be268f3181a902e1fe78883eb8f8aac679c9985c2ad13c6b9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-140.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-140.png
                                        • Size 1KB
                                        • SHA256 2637072751e1e6398c45d2c5b22c54adadfbbd4d3007238799f5da63f846167b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-140_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-140_contrast-white.png
                                        • Size 1KB
                                        • SHA256 ce3559b2efd6d547fb822440690cfbf793eb70c98154ad4dbf3a7c0e1af5e166
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-180.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-180.png
                                        • Size 1KB
                                        • SHA256 7ca510381079a4b166e9d5fcf0dc005d9606197e8636621b655d6459941139a0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-180_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-180_contrast-white.png
                                        • Size 1KB
                                        • SHA256 f7eb888cd9bce4641fcb01088b05be242f616dc06c3f823e51fb63b53b6f14f5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-80.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-80.png
                                        • Size 827B
                                        • SHA256 f287370ff8c7e2ba120407cafe09c1fce674ae8af5bd5fcc0c2dd1c6628b9ce9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        150x150Logo.scale-80_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\150x150Logo.scale-80_contrast-white.png
                                        • Size 799B
                                        • SHA256 0a9129bde051c17e96e516d5bc509e1a06a1e066a5e2796627cbef8630002b47
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-100.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-100.png
                                        • Size 781B
                                        • SHA256 fb5662c5fde7d49862da2e0253ae03dc7e5f9afd2edc65d4efa6dc3a3026156f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-100_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-100_contrast-white.png
                                        • Size 752B
                                        • SHA256 3fa9dfc982544f3ffda0795beec69c65d6c5883be0de37133466e643b5f3aeea
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-140.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-140.png
                                        • Size 991B
                                        • SHA256 84f8ebb629791e0b73cd53d7f3445d685145d0787a207e25842b237c98a8c99a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-140_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-140_contrast-white.png
                                        • Size 865B
                                        • SHA256 99cd2b5809ab9c604613b305bc80e6f68b858c1289c07e84aadabc4c3768ff32
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-180.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-180.png
                                        • Size 1KB
                                        • SHA256 c5d33ee3b5e8dcb9e9aeae5f14d0e92cf9bdc16d6245ce65dd4340c8a0be4f26
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-180_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-180_contrast-white.png
                                        • Size 1KB
                                        • SHA256 e5112331e0e2684ffb5adc0ac23324d9836cf067111f1f5834c77b1153a8a5d7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-80.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-80.png
                                        • Size 590B
                                        • SHA256 91ba72309e34c5336c09b8f5c787a6327082f275d5d7bfe491c5430e67c80752
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        70x70Logo.scale-80_contrast-white.png
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\Assets\70x70Logo.scale-80_contrast-white.png
                                        • Size 519B
                                        • SHA256 37b0f1fb4a08af8a42e6d8fce4c7380ddae0272150d7a9bb8b1d138066a9ffbe
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        assistant_package
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\assistant_package
                                        • Size 4.0MB
                                        • SHA256 d3db6378085b6ce536c560d45b54375807da6bb4be4819e0125e7f54e943c673
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        d3dcompiler_47.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\d3dcompiler_47.dll
                                        • Size 4.5MB
                                        • SHA256 3b42e20384e7d1515ec2fd7cfe82bb5f03cee0b9fab4cf39e912a56f39002c37
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dxcompiler.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\dxcompiler.dll
                                        • Size 24.7MB
                                        • SHA256 bdeca837a59d75f6d02b723ed9167a1359fa74fca0fd44a7e0982ea5f7ee8e61
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dxil.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\dxil.dll
                                        • Size 1.4MB
                                        • SHA256 ea56c20ead54660c7dfd844559de48708bc937c9283ef4fa3f33af871d02d734
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        files_list
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\files_list
                                        • Size 6KB
                                        • SHA256 a5bbae7f7160a98772a9d713ae501add9db6b80015bf11302d133c0052020290
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        headless_command_resources.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\headless_command_resources.pak
                                        • Size 3KB
                                        • SHA256 7c71d88913a88c6d0006b684055f3d136782aa1f6866ecafe2096b8aeae2e418
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        icudtl.dat
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\icudtl.dat
                                        • Size 10.4MB
                                        • SHA256 113f7464a507af4f7d2b0ea73094217881386f19dac7cacc5f071e7a4cf04a20
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        installer.exe
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\installer.exe
                                        • Size 8.4MB
                                        • SHA256 df8f4c8801bbdfc47af42be6dc6cd649188cabb99b3b5b3a232a9eb3381d93fb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        installer_helper_64.exe
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\installer_helper_64.exe
                                        • Size 607KB
                                        • SHA256 e3f94b159bd44a4272f46df048a368d949ef9e756e150c9213ef63763b9a2378
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libEGL.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\libEGL.dll
                                        • Size 451KB
                                        • SHA256 2f63ea3de4ad9e06b3cf6e5e9b2cc271f3ac52720c85ae8848bf55a8403e4743
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libGLESv2.dll
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\libGLESv2.dll
                                        • Size 451KB
                                        • SHA256 3e7106cea7a667ec547a53e589e3a4558cc2e9f03ab3e4bee3e1712600fbf669
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        bg.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\bg.pak
                                        • Size 983KB
                                        • SHA256 1dc471ddd2101d87e4e24882bdf678b255e6973fbc7d86f1bedf4ff2646fa503
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        bn.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\bn.pak
                                        • Size 1.2MB
                                        • SHA256 0adbfc8c0aea9d072c502d6801a29829e62028f31595b7bd134e949e6825d72c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ca.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\ca.pak
                                        • Size 619KB
                                        • SHA256 3f2e81140887b4c92ab2cacb287f1395364fcb698d9eb50e54f25f9137e6c8e2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cs.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\cs.pak
                                        • Size 620KB
                                        • SHA256 0483fae37cde542b5011e5d26b1ca57f69f37ce9fa44ecd28a8e8e670ab0f712
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        da.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\da.pak
                                        • Size 569KB
                                        • SHA256 1e68cd9d9988aefe17576f3c83f1543fa1ffcb972b22dfb1de1dcb2ab23ff423
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        de.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\de.pak
                                        • Size 617KB
                                        • SHA256 a400a05615fc1c964b0f9c63de7c2321a03e919be7c7b22c61f545837b9ac756
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        el.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\el.pak
                                        • Size 1.0MB
                                        • SHA256 5fc93d324372cf060857cf4a29bf31f689572914c92b24a8174a89a2c538115b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        en-GB.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\en-GB.pak
                                        • Size 499KB
                                        • SHA256 4c0eeb545466af9307b50c3cd8331532413f31b7bf7a359a9a6d31a6513ddc10
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        en-US.pak
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\138.0.6044.24\localization\en-US.pak
                                        • Size 503KB
                                        • SHA256 31d0d2140d3664754021877248cccf2ef54e4cd41bf8d98d00124e0111801142
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        installer_prefs.jsona8910365-51c7-4b76-87de-74fd3c878be1.tmp
                                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.jsona8910365-51c7-4b76-87de-74fd3c878be1.tmp
                                        • Size 1KB
                                        • SHA256 4c5e5c6749b2a6635e7962cf1721e9b56af5edf9683d02311ea29d5262a19a01
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Opera Browser.lnk
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\Opera Browser.lnk
                                        • Size 1KB
                                        • SHA256 c2275ceea7d49628fdcf5dbf223fff43b7a12008b7f6d49a18aa882f111bcc11
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        additional_file0.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\additional_file0.tmp
                                        • Size 2.9MB
                                        • SHA256 30786977e61add36f7c641facfb7fce1b2ec7c2a0a7e055a172f127a68788556
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        assistant_installer.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\assistant_installer.exe
                                        • Size 2.4MB
                                        • SHA256 e8dce277d6edb918499526fadba9902e317496c2af077219f263a7a643467824
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dbgcore.DLL
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\dbgcore.DLL
                                        • Size 196KB
                                        • SHA256 c16220edd3787da33dbd3ac2fcbec7de6a13e2baf14ae6105bba68d4efd83628
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dbghelp.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\assistant\dbghelp.dll
                                        • Size 1.8MB
                                        • SHA256 990b13e88b4a9985eb5c596078e2ec26a0edcc22169dd71f8a84c7943005306c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        de932af914ba00303d4a2778a383ac9c831101e2.crx
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\de932af914ba00303d4a2778a383ac9c831101e2.crx
                                        • Size 3.5MB
                                        • SHA256 9d645b0ce032688d4f3100cd1f1d178d3c2c9d04bb691144659b98b4931d8eef
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        installer_prefs_include.json
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\installer_prefs_include.json
                                        • Size 228B
                                        • SHA256 fb510f9f3decb14b00aa8a87149dbbdd4286ee684cce0fab0c996d15aa67d4a6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        installer_prefs_include.json931d7013-e0ca-41c9-94f0-c0754bf4b993.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\installer_prefs_include.json931d7013-e0ca-41c9-94f0-c0754bf4b993.tmp
                                        • Size 243B
                                        • SHA256 bb34cce4e4c695d363965ea84f9ddc9cb30ce8ee95bcef6140f159be43969430
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        installer_prefs_include.jsonb0977193-75b8-45c2-b400-46ab0c4a7922.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\f2b59e16-850d-47c1-9acc-4ff6ccd47422 Opera Installer Temp\opera_package_202610221710561\installer_prefs_include.jsonb0977193-75b8-45c2-b400-46ab0c4a7922.tmp
                                        • Size 1KB
                                        • SHA256 fbf22492d231fdc3559ffdc0f3d5a59120128d245fc28a1ce4a31925b7bbf372
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        installer.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS08050FD8\installer.exe
                                        • Size 8.4MB
                                        • SHA256 69ba0516f53a270d75435b2dcb059a77ea2e0dec2eaacff7c227c88efb694750
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        OpInst.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                                        • Size 3.1MB
                                        • SHA256 6a0881b11e96b00e2853094f67eecc06aa7a7ececcc2d27746185548e0349f08
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        bg.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\bg.png
                                        • Size 224KB
                                        • SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        favicon_opera_one.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5208_1965704607\CRX_INSTALL\favicon_opera_one.png
                                        • Size 2KB
                                        • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        manifest.json
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5208_1965704607\CRX_INSTALL\manifest.json
                                        • Size 3KB
                                        • SHA256 04dbe0c15af570ccff856c4bb005419e343ba39092eaeda1116b91a8e5961523
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        reader_mode.js
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5208_1965704607\CRX_INSTALL\reader_mode.js
                                        • Size 112KB
                                        • SHA256 ebb002d9d7d9206bc39d3f44bae6e49b7d694a172a0b1da9934f49c17f433084
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        service_worker.js
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5208_1965704607\CRX_INSTALL\service_worker.js
                                        • Size 1.1MB
                                        • SHA256 055406577738ff3eac762b7d2e7360bac21acf0bb688d829d0acfb9126993de2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        spotify_frame_interceptor.js
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5208_1965704607\CRX_INSTALL\spotify_frame_interceptor.js
                                        • Size 5KB
                                        • SHA256 f25cc540e5212f9f327bfb16702e156d385aa2545bd1b4c572f6a5543d4e7930
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        logo_128.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1262223465\CRX_INSTALL\public\icons\logo_128.png
                                        • Size 7KB
                                        • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        logo_16.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1262223465\CRX_INSTALL\public\icons\logo_16.png
                                        • Size 653B
                                        • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        logo_32.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1262223465\CRX_INSTALL\public\icons\logo_32.png
                                        • Size 1KB
                                        • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        logo_48.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1262223465\CRX_INSTALL\public\icons\logo_48.png
                                        • Size 2KB
                                        • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        logo_64.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1262223465\CRX_INSTALL\public\icons\logo_64.png
                                        • Size 2KB
                                        • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        messages.json
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1338760228\CRX_INSTALL\_locales\en\messages.json
                                        • Size 396B
                                        • SHA256 1bcb4888a65788a50ed88f4bd95955d1dafdc950b5ef4609b37f42934a4bf3b9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Neutral.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1338760228\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                        • Size 2KB
                                        • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Neutral.png
                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6944_1338760228\CRX_INSTALL\icons\32\Icon_Light_Neutral.png
                                        • Size 962B
                                        • SHA256 e8adb8a9dcca121a1853749ebef122b84a995ebf8775cd27b0dd54bab9840bd1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                        • Size 40B
                                        • SHA256 f27c67979c8b6aa404438fc691dd9e831b3d7dd75ef1a74abb3b3f6f97b74592
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        BookmarkMergedSurfaceOrdering4e3008f5-e64d-4c14-9d10-1689e888be22.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarkMergedSurfaceOrdering4e3008f5-e64d-4c14-9d10-1689e888be22.tmp
                                        • Size 6B
                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Bookmarks81b2b088-717a-474d-831e-2e43cd899548.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Bookmarks81b2b088-717a-474d-831e-2e43cd899548.tmp
                                        • Size 34KB
                                        • SHA256 e328b8369eeef904fed97be97cf6f50c544c5affc9a8ae2a1f71cb428291d90e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        BookmarksExtrasada8f25a-c843-411e-9610-364a84caeb7d.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtrasada8f25a-c843-411e-9610-364a84caeb7d.tmp
                                        • Size 226KB
                                        • SHA256 3bba8701a9ef2f6d0b707012a5d52515a883c00cec5d1a2ecc2fbc6627dabead
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        temp-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
                                        • Size 336B
                                        • SHA256 fcdc1d519b19c2ab831c141c6d0e9080abc95b84431fe17d625cad0d35a0e53e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        temp-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
                                        • Size 1KB
                                        • SHA256 38e13d747138b2481543019b55ac2a3a7699a8c33196af847d8a35e612084f28
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\wasm\index-dir\the-real-index
                                        • Size 48B
                                        • SHA256 5103a8da8d61843d5850bbc1eaf0e8dcd35e89e3d54892106eafa7e730edde83
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        data_0
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_0
                                        • Size 8KB
                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_2
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_2
                                        • Size 8KB
                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_3
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_3
                                        • Size 8KB
                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        MANIFEST-000001
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extension Rules\MANIFEST-000001
                                        • Size 41B
                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        main.js
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.9_0\main.js
                                        • Size 48KB
                                        • SHA256 c2d961a8340848930aa0b7141ec03b973639d119756904d35fc8efe1a4cb8ec7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        scraping-method-Dq4mm50p.js
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\scraping-method-Dq4mm50p.js
                                        • Size 6KB
                                        • SHA256 99c8d4f76ebc9fc6cea115065570a12d41903c93e18c1c6385b5b2e70256eb70
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        service-worker.ts-fle0M1Xd.js
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\service-worker.ts-fle0M1Xd.js
                                        • Size 13KB
                                        • SHA256 4ebb6cb9c3f033302d6a8c31329009082bafeab73c39cca179511b5a972ba8f8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        service-worker-loader.js
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\service-worker-loader.js
                                        • Size 49B
                                        • SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        messages.json
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\_locales\en\messages.json
                                        • Size 429B
                                        • SHA256 c6a7161359e3c4fbc4059b7209c585f9aa2306c08e6c39a3003f4b29f2ceb22d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        background.js
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\background.js
                                        • Size 105KB
                                        • SHA256 9a9b0f7b3070d6f47773e487ebf53134c7629c15c4564ca613c3c9a8077b543d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        content.js.LICENSE.txt
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\content.js.LICENSE.txt
                                        • Size 1KB
                                        • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Active.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Active.png
                                        • Size 2KB
                                        • SHA256 97d9553a4f725354a6d5c3eff11f31285fd89c3b150593f04785b83d0a56efc2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Available_Red.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Available_Red.png
                                        • Size 2KB
                                        • SHA256 9eccebdbdb61efc0cbd8bccf3a5fedc6f9a1ebe5084b160783f90a56cd1efa7b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Available_Yellow.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Available_Yellow.png
                                        • Size 2KB
                                        • SHA256 c165ef60bf3806cd0a7121a8d6cfd06909fc84b38a07d43e809bd7bff564099c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Neutral.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Neutral.png
                                        • Size 2KB
                                        • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Active.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Active.png
                                        • Size 883B
                                        • SHA256 50aa1dcfa9083b57dd6187752b2c149294210be12d263b793d27daf8d431954c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Available_Red.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Available_Red.png
                                        • Size 895B
                                        • SHA256 2278e95b28851ade57217ab5c7b32598c44e1085693a3e26379643d29fa0a6d1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Available_Yellow.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Available_Yellow.png
                                        • Size 895B
                                        • SHA256 726a50a9c008449ab7bafbf21325bfc72093b7ae6a56c5be90cf8c32a8a44641
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Icon_Light_Neutral.png
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Neutral.png
                                        • Size 932B
                                        • SHA256 b8e92f9e9b9dc82799231b8d1b57091a9d0bcdd9b54615f86e8c4e4e5c9f036b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        index.html
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\index.html
                                        • Size 222B
                                        • SHA256 fd21c7ca4637b0221250a14b9fcfb6ebc3b734e659ad80151be4bc579db818f1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        rules.json
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\rules.json
                                        • Size 839B
                                        • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        0893b501-3a16-4fed-8761-27a330586d54.tmpf7fad559-8162-4818-83e8-47923354e28e.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\0893b501-3a16-4fed-8761-27a330586d54.tmpf7fad559-8162-4818-83e8-47923354e28e.tmp
                                        • Size 27KB
                                        • SHA256 1b6cb01715a2de1373f9f3e194921621463532558767bb5d6e1902e9b368ca5c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        0a10c984-9bc4-4bae-aced-c5690151dda6.tmpa4a71ae3-26b0-4cb0-b333-75da943be87c.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\0a10c984-9bc4-4bae-aced-c5690151dda6.tmpa4a71ae3-26b0-4cb0-b333-75da943be87c.tmp
                                        • Size 27KB
                                        • SHA256 24683ea67b7b390d33c1d607fc44a309989ada5a9fa5fb4ec96a96fda96d44ff
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        146791a5-873e-4147-94bd-8273abfd4de2.tmpb1ddf58f-f8df-4f6e-b38f-56b3268930f8.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\146791a5-873e-4147-94bd-8273abfd4de2.tmpb1ddf58f-f8df-4f6e-b38f-56b3268930f8.tmp
                                        • Size 27KB
                                        • SHA256 aaa2c3089c7623aefb9025744747ec651dfa14d9decbe63ce941785b4202f1e6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        5d514dc8-13bb-4016-b3cf-43996f2b168e.tmp7a795c30-609e-4c5e-aa9e-f95736c47411.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\5d514dc8-13bb-4016-b3cf-43996f2b168e.tmp7a795c30-609e-4c5e-aa9e-f95736c47411.tmp
                                        • Size 27KB
                                        • SHA256 cc95dbf2bf56e0090333afdab1e6cb96d1614f08ba82bd15f2da37913334c491
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ac58bfbe-4644-4af7-9307-2d0b3ad08689.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\ac58bfbe-4644-4af7-9307-2d0b3ad08689.tmp
                                        • Size 27KB
                                        • SHA256 b8f0a6164e126d0f70798a96f456487080b5473bee571bb9594600f8a53901c7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        f3c8d3b4-22cd-448f-94be-57ef8023acf7.tmp2fa5cf2a-11cc-4756-ae1a-55a82ec6826b.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\f3c8d3b4-22cd-448f-94be-57ef8023acf7.tmp2fa5cf2a-11cc-4756-ae1a-55a82ec6826b.tmp
                                        • Size 27KB
                                        • SHA256 81c54325adf7d351dffacbd1fd0eb15655795d84a6c63682d5a8ea95a11f7a20
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Network Persistent State
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State
                                        • Size 111B
                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Network Persistent State849ebe4b-c59b-4759-8280-6244db649515.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State849ebe4b-c59b-4759-8280-6244db649515.tmp
                                        • Size 965B
                                        • SHA256 b35f3143739e16860e74c69480bf011799d947038a5ea0d7f7dead7ec2977b3c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        SCT Auditing Pending Reports
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\SCT Auditing Pending Reports
                                        • Size 2B
                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Preferences459dfad1-c94f-4b6f-b496-c9f5ebb2581b.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences459dfad1-c94f-4b6f-b496-c9f5ebb2581b.tmp
                                        • Size 15KB
                                        • SHA256 4899e67aaa00871cb09af9dcbc18f4530e3d710d520e2737c0ab6b991f5832d0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences4d5a22d8-470f-4db7-8143-17e98bcb5e96.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences4d5a22d8-470f-4db7-8143-17e98bcb5e96.tmp
                                        • Size 15KB
                                        • SHA256 f38934c909a18316cb0df80865800351bfea505a277b784126f5f6815e9f0a90
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferencesd7b8b1a6-644a-4878-8501-958d72d69995.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferencesd7b8b1a6-644a-4878-8501-958d72d69995.tmp
                                        • Size 15KB
                                        • SHA256 5bbb1d9076294d9372268216fdc1d1ad31362984e0a2f27ad8cf2e5bb2cafba2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferencesf5cee0d0-8187-4bff-997e-5a2692f4fa70.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferencesf5cee0d0-8187-4bff-997e-5a2692f4fa70.tmp
                                        • Size 10KB
                                        • SHA256 d2e6d703d480007105a6a5f12d3fb67628a828aec252e8c511b19f553ad6ed09
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Secure Preferences1dd1f5f2-8e53-441a-b470-56a17797e003.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences1dd1f5f2-8e53-441a-b470-56a17797e003.tmp
                                        • Size 82KB
                                        • SHA256 94b320593d63de79c57f901e1620ab80fa31c1b2582b998a91cb847dbfdc1d11
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Secure Preferencesb5250cf0-9c0b-4c88-8db1-c36f45af2c4c.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferencesb5250cf0-9c0b-4c88-8db1-c36f45af2c4c.tmp
                                        • Size 109KB
                                        • SHA256 abb9b88003f9176182f765e57a8dde5cc0b6415ec0bd765d97df1944d2f59153
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        temp-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                        • Size 96B
                                        • SHA256 5a25179f5c1fa64c6698d5e2fb995ee08b9a288ec2c222c0b448f2b2b78b8f88
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        temp-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                        • Size 456B
                                        • SHA256 1f93d944229d1704033350752467713720e9507a2b7b4ea26d892743b81b5025
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                        • Size 72B
                                        • SHA256 82ed3ad22f8372ff2e2951f1a90b54badf0c7f97fe0343a4aa7416dd5be611fc
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        index
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Shared Dictionary\cache\index
                                        • Size 24B
                                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Site Characteristics Database\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw
                                        • Size 381B
                                        • SHA256 e18dfd7a12b68ff4330e62be819289f4f1f31eaaa4de284ce1969919d1a5b461
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw0949f5da-853a-4bf5-9ac6-5d5dd233e658.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw0949f5da-853a-4bf5-9ac6-5d5dd233e658.tmp
                                        • Size 1KB
                                        • SHA256 d38eecf24003891966a73d42d3be46e38df59bc78fa4d276fd2cef930368d366
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw3136de0a-efd3-46ed-a407-5f414ff4f72f.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw3136de0a-efd3-46ed-a407-5f414ff4f72f.tmp
                                        • Size 1KB
                                        • SHA256 90bd7e0886b2325e5daa4cf92432379aa804715729482d9989e22df218fabdeb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw332a762c-03a9-4ca1-9c95-88d38852eaae.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw332a762c-03a9-4ca1-9c95-88d38852eaae.tmp
                                        • Size 957B
                                        • SHA256 ff72438227e6f9af43a513dbc550f09911f8cd79c553df2f73bfa83599803828
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw35d50e62-b980-4a53-a817-d42b552a00cd.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw35d50e62-b980-4a53-a817-d42b552a00cd.tmp
                                        • Size 493B
                                        • SHA256 9dce3eb0e7f11991f99b92d283a8a8658f9c81a1ca1a5734c952ba65c60f0482
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw4d5ae415-e530-4e70-bfbe-3641c4ed62b1.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw4d5ae415-e530-4e70-bfbe-3641c4ed62b1.tmp
                                        • Size 1KB
                                        • SHA256 e1085eacff776e79462b4a81bf21c3126c96c5bf13815d4d271c38f36f3c144e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw7bd01719-0d27-4785-b41b-3d15da2ccf6c.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw7bd01719-0d27-4785-b41b-3d15da2ccf6c.tmp
                                        • Size 1KB
                                        • SHA256 ca4dce5d590f43f3e008bb45a07f9945fb3320b212d091ac3f5fd04f02a94b12
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw82f8a6ac-5396-4441-a56c-4424a6dd1485.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.raw82f8a6ac-5396-4441-a56c-4424a6dd1485.tmp
                                        • Size 941B
                                        • SHA256 e283a48026026b513ac12b565770c06624c0de9556f18acff53a7f12435e17dd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawa2fad19f-1873-4a78-9b47-57e378c7d6e1.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawa2fad19f-1873-4a78-9b47-57e378c7d6e1.tmp
                                        • Size 781B
                                        • SHA256 8861573a7eb2c25dcda33411e9b3e81c49ef43307279820f3883d828fd06fc3b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawad8c3228-58a3-4590-957e-5aff434c2bea.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawad8c3228-58a3-4590-957e-5aff434c2bea.tmp
                                        • Size 1KB
                                        • SHA256 52a4e9c452700c718ce13d7671c2ae68faf97658ff8346fe393e1e150e11b3ed
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawe9f7bfdf-0f41-47c3-8ed7-eeca0885204e.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawe9f7bfdf-0f41-47c3-8ed7-eeca0885204e.tmp
                                        • Size 1KB
                                        • SHA256 eb52660c73d0b2ae03c6de01764843f8028d8e380ce91280e605599b5fda4416
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawf80c0585-eab6-4034-ac31-35a03d45f07e.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawf80c0585-eab6-4034-ac31-35a03d45f07e.tmp
                                        • Size 957B
                                        • SHA256 888d349945b02db0b8e663fe0b3f4c204e9ed225b5c63d0e575b33fa99e02fb5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawfc8d8fc0-ddcc-4f00-954a-a8383d80d6c3.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_240c4ad8-2c60-4673-8e46-ba98be68abdc.rawfc8d8fc0-ddcc-4f00-954a-a8383d80d6c3.tmp
                                        • Size 605B
                                        • SHA256 9ddfc7afe944b870b3a21eb11c27f186a37fbb616374c5b48aabe43304d2aff7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw
                                        • Size 381B
                                        • SHA256 7b0221e3018f8148c99b1afe0f4ec9cb01fbe7d8621658271083e939aead2ba3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw091132cf-ecf2-4d1f-889e-ffdefe29c45a.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw091132cf-ecf2-4d1f-889e-ffdefe29c45a.tmp
                                        • Size 10KB
                                        • SHA256 18be29a33791d76847107f3ea4450210ecfb707cd25aef822d1de50bc4c3e55f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw096a8c1d-5d09-4cc5-b11f-7e8fa234a5cc.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw096a8c1d-5d09-4cc5-b11f-7e8fa234a5cc.tmp
                                        • Size 8KB
                                        • SHA256 d4959954f6f8c2473b5db438828a47cc9723f0c8a676f53fd8f948f7b308a420
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw0e40961d-495a-44b0-b58e-22a2c54d6a00.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw0e40961d-495a-44b0-b58e-22a2c54d6a00.tmp
                                        • Size 1KB
                                        • SHA256 79f332ae7a5b7849ee7bcfe0b28a009a8b57ce76197302c8ed7bedc3dcc800a3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw1209a7d9-c312-4a9c-9c4e-1e900aa0e014.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw1209a7d9-c312-4a9c-9c4e-1e900aa0e014.tmp
                                        • Size 925B
                                        • SHA256 d5f6e34515a125822b70f6502dcfea6fb9067971abbfffb6d998547e305ee77b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw13dfc222-5d58-4259-bc90-e7a3022e7d27.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw13dfc222-5d58-4259-bc90-e7a3022e7d27.tmp
                                        • Size 10KB
                                        • SHA256 8fd311fcab8e8ded99de52c48813e73be73d8f1dd260b8d41ff42ffc30a75d04
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw179aa8bb-d31e-44bc-b89c-489336d8be6f.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw179aa8bb-d31e-44bc-b89c-489336d8be6f.tmp
                                        • Size 10KB
                                        • SHA256 492510da48ae4b3ffcb5c506dafe8eb6ad8a2cb3b67c19a485241a9dd3f12672
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw1d04b0db-77db-4296-976b-1942beedff58.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw1d04b0db-77db-4296-976b-1942beedff58.tmp
                                        • Size 9KB
                                        • SHA256 70a04ff908b9e857f43c00813355bbddddfdf6ee65c89a51b9e0ccb60557df60
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw1d6e04e0-a29f-435a-8a94-7447b59498a9.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw1d6e04e0-a29f-435a-8a94-7447b59498a9.tmp
                                        • Size 493B
                                        • SHA256 b68cfa1e1add21b1b81b57c17ed1136395bce7d32aafe5d208608fac87987f67
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw20aa958d-a765-4068-b873-79f07634b65a.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw20aa958d-a765-4068-b873-79f07634b65a.tmp
                                        • Size 6KB
                                        • SHA256 982ab3b43087aff25396f512dab4e5b76b060e7eec6802bfcfdc2514762f6909
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw239c415d-19d6-471c-a337-68b3f18a93fc.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw239c415d-19d6-471c-a337-68b3f18a93fc.tmp
                                        • Size 8KB
                                        • SHA256 94c3ca7ded0a0d49ddc44baa740c25efc1d21b6c6eecf22fa86ee3db1e075b1e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw24f2663e-041d-4688-9404-2ada5820232c.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw24f2663e-041d-4688-9404-2ada5820232c.tmp
                                        • Size 621B
                                        • SHA256 58ffd738b9a62d86d1b04458cba3e248b934cb828fa04bdeebbd8946197a8fae
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw26d4db39-df94-465f-9406-e6b930ad2235.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw26d4db39-df94-465f-9406-e6b930ad2235.tmp
                                        • Size 9KB
                                        • SHA256 77b4fd71c2b31398c980f3d33bb5f2518b6f42f5c85d532c80dbee4c96b88d1c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw2e16b635-d718-499e-8b79-4c25f2b5f3f0.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw2e16b635-d718-499e-8b79-4c25f2b5f3f0.tmp
                                        • Size 7KB
                                        • SHA256 5ee899bba7c8241a1d378f623a58d4039235dbd1d4ab49087ad580346a513876
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw2f626e9f-423a-4b6d-9eed-5316ad29f440.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw2f626e9f-423a-4b6d-9eed-5316ad29f440.tmp
                                        • Size 10KB
                                        • SHA256 55a0d080acac2c972b7da8cc96c65e8ce67c21ccd342892ac82d8dbf743165ea
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw334bb208-19bc-4686-809c-1cf0f71489c8.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw334bb208-19bc-4686-809c-1cf0f71489c8.tmp
                                        • Size 1KB
                                        • SHA256 8525d09159cafb208be2886a79bc9957ec70dcddd3ab8671cafaecf9ba97b0f8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw3486fada-fa32-48ae-8466-091591ef1185.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw3486fada-fa32-48ae-8466-091591ef1185.tmp
                                        • Size 8KB
                                        • SHA256 c5a9bb30270e367fb3d2a397f0f6c307fcad01c2c40ffb4df984d95baf4d01f9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw3b2228a7-398b-4325-813b-a62fc0bedc32.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw3b2228a7-398b-4325-813b-a62fc0bedc32.tmp
                                        • Size 1KB
                                        • SHA256 228a9819004465ef6e068be17098a19e7c0d114fcbee5070b807d725d23140e5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw3b637149-1969-47e1-97d3-1cb005c41ec7.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw3b637149-1969-47e1-97d3-1cb005c41ec7.tmp
                                        • Size 10KB
                                        • SHA256 491a041ed459c90fc376a6b840f2105533e623dc5de3fa93060042f1ac97d05a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw4c16c23d-f748-4e14-9a09-169fd5494c99.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw4c16c23d-f748-4e14-9a09-169fd5494c99.tmp
                                        • Size 9KB
                                        • SHA256 eb67a0494574fc1ce76abd26d0d6bb2e0fc392e28462dc4ee4bd7bf69e68ea68
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw57831af8-2bb9-4be0-8e33-79ae9202c826.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw57831af8-2bb9-4be0-8e33-79ae9202c826.tmp
                                        • Size 1KB
                                        • SHA256 bb54a93c7911d82124002f8b5180d2a9ebe9df1b794750729e6ca6331f53b780
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw5e42fc2c-5b1d-4159-a703-fe05cc1c98f7.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw5e42fc2c-5b1d-4159-a703-fe05cc1c98f7.tmp
                                        • Size 6KB
                                        • SHA256 d02fad6def17b85e70b1a8f010e0c75d70405823b778fd23806d07e4d94ea606
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw63311a9c-566f-449d-afdf-616bcf916a3a.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw63311a9c-566f-449d-afdf-616bcf916a3a.tmp
                                        • Size 973B
                                        • SHA256 499e2db46b651f0274fab1cdbb20d1cab02d7c47b88d458b28f08a3a91bea1a6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw6e6dda08-cbb2-4ee8-be10-dd52f46a8c77.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw6e6dda08-cbb2-4ee8-be10-dd52f46a8c77.tmp
                                        • Size 8KB
                                        • SHA256 ef0c7da5c010bf6fa40cd639bf4fd2b6a779fd3311090db91d59ba5c25238e56
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw6ff930b0-5813-46fc-a85a-9ab3b70772f3.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw6ff930b0-5813-46fc-a85a-9ab3b70772f3.tmp
                                        • Size 9KB
                                        • SHA256 6a258c71f426455c80bcdd68c38259cae308b68b39948779ac848748b2f39b3e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw7698cfd7-1df5-4464-ae6b-e0c60482ff73.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw7698cfd7-1df5-4464-ae6b-e0c60482ff73.tmp
                                        • Size 1KB
                                        • SHA256 ba6d01d2a02e57ac4f8f7e15f8517b529e9ab7ee41af6ab4a81e5beb5bc6d09d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw792d39b0-6802-469a-952e-5ef0a01f0b0b.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw792d39b0-6802-469a-952e-5ef0a01f0b0b.tmp
                                        • Size 8KB
                                        • SHA256 091b9532262a8e08dd1c6487c6abf36493b830069371fc8cf6e68c944c6baa27
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw8061d58d-c565-4471-b88f-59760a182053.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw8061d58d-c565-4471-b88f-59760a182053.tmp
                                        • Size 1KB
                                        • SHA256 a340762453cfb132645898020d13c9fe66c6ff7f19a319024b180c2b16b08883
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw818fc1be-0b32-45c7-a078-46371f6c0126.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw818fc1be-0b32-45c7-a078-46371f6c0126.tmp
                                        • Size 6KB
                                        • SHA256 89c8ce9c490f975d2c8b4f1f05578e1c267f1664ec6f4bec09157a116807c5d4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw83496178-915b-40f3-9f3f-5a88e8e714a1.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw83496178-915b-40f3-9f3f-5a88e8e714a1.tmp
                                        • Size 9KB
                                        • SHA256 4de485128f768a055b4270e54769dd88783304d15fee70975016344585aa5ea1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw873abc2c-c14d-4a96-abff-88097aa8acd1.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw873abc2c-c14d-4a96-abff-88097aa8acd1.tmp
                                        • Size 6KB
                                        • SHA256 d39460680e38af46e6ce71d788688c640cee63e576ebcc3ade5d1a7149b9c22f
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw8c3c79f7-c0d9-4b48-9549-b4c51deb783d.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw8c3c79f7-c0d9-4b48-9549-b4c51deb783d.tmp
                                        • Size 8KB
                                        • SHA256 91510c4959d4a2b0ddc13793ba10681be6dc4d8d565bdf17ae20d8096cb857e0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9734d7e0-4d43-4add-9927-a126ac1d38fe.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9734d7e0-4d43-4add-9927-a126ac1d38fe.tmp
                                        • Size 9KB
                                        • SHA256 b38bd0941d06f0050ff355f06ccbaaccf5e848a74254071a4a8cac06c88d3a1c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9c33e159-559d-4804-8f9a-e22be17cd15e.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9c33e159-559d-4804-8f9a-e22be17cd15e.tmp
                                        • Size 1KB
                                        • SHA256 922d97f5b837db558d6ca81f1deeeaa1c3a8ee31990647755fe9fcc9aa4f0040
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9fa49d24-c341-4d77-8d19-df6f702780de.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9fa49d24-c341-4d77-8d19-df6f702780de.tmp
                                        • Size 9KB
                                        • SHA256 18c85c3ee7b09332e0de10eeddf355fbe2775fb041fad7326f477e81f052d867
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9fd594c7-e813-4353-a8dc-c0d60e7e797b.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.raw9fd594c7-e813-4353-a8dc-c0d60e7e797b.tmp
                                        • Size 749B
                                        • SHA256 4c82682964a4d03a2fd1b46cd514a0341090606eace9b3f7060dec4fad2dcc53
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawa5b4b1c9-3321-4cd7-90a5-1302022ef546.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawa5b4b1c9-3321-4cd7-90a5-1302022ef546.tmp
                                        • Size 7KB
                                        • SHA256 f1c647f642653b4e772572699909ca24daf7b0311573d2620818e567e8563f55
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb089e211-9ebc-4d0c-93d6-76e3fbb6b1f1.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb089e211-9ebc-4d0c-93d6-76e3fbb6b1f1.tmp
                                        • Size 8KB
                                        • SHA256 7e96c2605b8697aa9f4980e7b7feeb87ba62352d0dfc3d220d2e4b40075af115
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb1f88c6e-f66c-4d93-9b74-6b0bfa5d4fbb.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb1f88c6e-f66c-4d93-9b74-6b0bfa5d4fbb.tmp
                                        • Size 8KB
                                        • SHA256 f37499c610601f40ce8014a5f915506743d93ff4b5ee4360a3ee6e4b831fd4db
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb25f2e70-a81a-49df-930d-a1a23173df43.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb25f2e70-a81a-49df-930d-a1a23173df43.tmp
                                        • Size 9KB
                                        • SHA256 10f2813f7fcb59d18088fa29215ba594c9d7f5f7f3835d0660ba26cff11099d0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb5add2ca-58c3-4795-806b-e967ec03cd00.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawb5add2ca-58c3-4795-806b-e967ec03cd00.tmp
                                        • Size 1KB
                                        • SHA256 20f1fe037019712e4dbefd989c135b1f5024d41c3efbdf82c7d6df1ef6a2e965
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawbc47a519-8013-4680-8cb7-6cf0c5abeeaa.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawbc47a519-8013-4680-8cb7-6cf0c5abeeaa.tmp
                                        • Size 1KB
                                        • SHA256 4fd4307d7c667622c89b848e8fb4f558bebf32a301c4f00efd692da9253e405d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawc6ebebb5-f440-4248-8bf4-e2839c411bdb.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawc6ebebb5-f440-4248-8bf4-e2839c411bdb.tmp
                                        • Size 9KB
                                        • SHA256 a3236820f027500bd43f0a5b3ba36810b1c044b11c12737ea612171f4565f384
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawcd02cde8-e407-4bda-adeb-a7c8e7ccd8cb.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawcd02cde8-e407-4bda-adeb-a7c8e7ccd8cb.tmp
                                        • Size 10KB
                                        • SHA256 f120e53c76bd1eb6365e32c19415bf246a62d159c3f4cb4963a5fd8cba4da5d6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawcda38754-5482-40f2-98c1-4bb0644aff42.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawcda38754-5482-40f2-98c1-4bb0644aff42.tmp
                                        • Size 9KB
                                        • SHA256 240cd8dbb85861b230bcd74995fa6a3fa3a2df3caa7477d7a468d873993455fb
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawd6b415de-1f30-4f6e-a6b1-cbe85eecd543.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawd6b415de-1f30-4f6e-a6b1-cbe85eecd543.tmp
                                        • Size 8KB
                                        • SHA256 6ec1d6952535c70aede779077fd3c98de41ae4f43c0257c4f26bf46c17197e63
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe01406c0-bedb-45ae-bc17-ce3c00b50da7.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe01406c0-bedb-45ae-bc17-ce3c00b50da7.tmp
                                        • Size 9KB
                                        • SHA256 e4cf9f84b8e88e8ba504b9841e99141219e77bee7448db2ff4320989a1f7a927
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe043f94a-dd14-482c-8ebe-7063801b7b04.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe043f94a-dd14-482c-8ebe-7063801b7b04.tmp
                                        • Size 10KB
                                        • SHA256 0993fe036fd6c9b4690b54cf3a382b046e186d4c7f16ff273ae6ff7d6ad71423
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe7c36ee6-78dc-42ea-98d1-4b29aff55ce6.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe7c36ee6-78dc-42ea-98d1-4b29aff55ce6.tmp
                                        • Size 10KB
                                        • SHA256 468bbdeffd2594d63726e8ee0c1daaff5d24ee05f410d53c3aaee12b4eaf2a1c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe9fce4a1-baac-4648-b6b4-13b21d1a83e5.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawe9fce4a1-baac-4648-b6b4-13b21d1a83e5.tmp
                                        • Size 9KB
                                        • SHA256 32f281129680a8da5f533bd5702e7c9b60f02ef445686badfb38ac802ab0aaff
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawf93e7ce3-e7bf-40db-834f-be70b74b7c53.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawf93e7ce3-e7bf-40db-834f-be70b74b7c53.tmp
                                        • Size 9KB
                                        • SHA256 f2c0fb0048930a066d5ed325dd8b1160d294bedaed9d28b8a149727c5897a506
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        session_65cb6517-491d-4296-bff2-8cce59a7c220.rawfa47fa37-e1d7-44ff-91fa-15a6fe5a3c24.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_65cb6517-491d-4296-bff2-8cce59a7c220.rawfa47fa37-e1d7-44ff-91fa-15a6fe5a3c24.tmp
                                        • Size 10KB
                                        • SHA256 948125b4436cc29a1a6def67f1939bf96b0034b7d1d18d52dd7a243084edb92b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        rhs.dat
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\rhs.dat
                                        • Size 113KB
                                        • SHA256 ec48b44b406c128cefe7e1cd672b0290ee87d91e9ca01302b53f93d793e96b11
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ssdfp5208.0.708929674
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp5208.0.708929674
                                        • Size 203B
                                        • SHA256 f22622cb784551684c268033fbca6892390cfcfc0a5d1de19121e02e23dd8b13
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp5208.0.7089296744c3a7e63-063f-4af5-a2b7-47d3f4c0eee1.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp5208.0.7089296744c3a7e63-063f-4af5-a2b7-47d3f4c0eee1.tmp
                                        • Size 265B
                                        • SHA256 0a90da3917d89705689096b610ec25b2499ea2e6dc759f6d497f261d96203878
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp5208.0.7089296748ef0713e-4608-43b3-a64d-774a8b585b84.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp5208.0.7089296748ef0713e-4608-43b3-a64d-774a8b585b84.tmp
                                        • Size 1014B
                                        • SHA256 120b065c55481c4b1d6edda19187982160deef845f8e8929daa6b524756822d7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp5208.0.708929674c20d8567-94bc-420c-9295-7a7072c00634.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp5208.0.708929674c20d8567-94bc-420c-9295-7a7072c00634.tmp
                                        • Size 1KB
                                        • SHA256 74ca9a9dbdd4bd9673831830ea6e3bcaa8ebce5165c9b4302970eef5d9f31445
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847
                                        • Size 457B
                                        • SHA256 37714550be29434060c1d7a2b242ef1e092c554d824b6b2445bf987b6aca7b5e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.6585738470b35ab17-c19d-4c9d-9f67-a1485ade88b1.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.6585738470b35ab17-c19d-4c9d-9f67-a1485ade88b1.tmp
                                        • Size 2KB
                                        • SHA256 cdf156d8eec3652ef396cb7c101dfe94851ae29aada97542326bdd99d443257b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847107688a7-311d-47e7-ada1-67e3a3794bb9.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847107688a7-311d-47e7-ada1-67e3a3794bb9.tmp
                                        • Size 3KB
                                        • SHA256 c409d76f505804ba3d6163564ad0da91f654c966d85eb8b55887009fe2e5b579
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.65857384722b079f4-1168-414a-bd67-fdf62618d406.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.65857384722b079f4-1168-414a-bd67-fdf62618d406.tmp
                                        • Size 555B
                                        • SHA256 44c8748e3ab6073fc079fa0e1f47c27982a8df2e33eeef70ac46198d9182b39a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.65857384736553c81-ebc9-4058-bf3f-46b7d95a6f77.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.65857384736553c81-ebc9-4058-bf3f-46b7d95a6f77.tmp
                                        • Size 1KB
                                        • SHA256 acccf23a1e78ed480d7bff159d475eb910b13e652674b77b974883c602152c0f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847499604d0-30f4-4977-8dc5-de125f67f25a.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847499604d0-30f4-4977-8dc5-de125f67f25a.tmp
                                        • Size 1KB
                                        • SHA256 a8069ca481eff069f8cf081e982b6a7810bdda51832f5c87dec01ba8f2ae0da9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.65857384756b91de8-9ebc-46a3-8075-4fae12318989.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.65857384756b91de8-9ebc-46a3-8075-4fae12318989.tmp
                                        • Size 3KB
                                        • SHA256 c3ab512e7c2b7da1a3cdfca2d141e49a52b1b4c66d39450c227083956873ebcd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847655e1ed4-5c2e-4763-951b-443a0b134f4f.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847655e1ed4-5c2e-4763-951b-443a0b134f4f.tmp
                                        • Size 3KB
                                        • SHA256 5fd5a5442e24102fe4544431838914d14344d43bf6f18ca624b7535e38a25ef6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.65857384778fed698-9b4f-438e-90ba-d5aa67369662.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.65857384778fed698-9b4f-438e-90ba-d5aa67369662.tmp
                                        • Size 1KB
                                        • SHA256 81e93ebf1e78a2a1d380fe27192282cfa65d5ab8279bd68571afba05509b289c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.6585738478251fec2-0162-4001-9c87-5d3c5667bd9e.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.6585738478251fec2-0162-4001-9c87-5d3c5667bd9e.tmp
                                        • Size 1KB
                                        • SHA256 11471b80161542da658d9bd2671d4a53f5229013c0a29f7d3455a14d83e927f5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.65857384787cfd3da-345a-481e-b00d-00e4be021fbe.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.65857384787cfd3da-345a-481e-b00d-00e4be021fbe.tmp
                                        • Size 732B
                                        • SHA256 c32c368ec487b2fe84074d01eb4ebb9088c852c94f5b3212d8f294a3836a8f50
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.65857384795b2a38b-f58c-44b2-8c69-a820f652779f.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.65857384795b2a38b-f58c-44b2-8c69-a820f652779f.tmp
                                        • Size 3KB
                                        • SHA256 c8261250eed863045b3acf064f53a737bb83bac5a4aee301d01a3052027ae625
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847a4f6c8c5-09aa-4b9b-9c5e-368175f6b426.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847a4f6c8c5-09aa-4b9b-9c5e-368175f6b426.tmp
                                        • Size 3KB
                                        • SHA256 58aaf7b4c70217599ce53ae284e3fbda54cc80c73d20b33cb636c1c91abc6375
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847a7f34128-2f5f-457a-a14d-21cafc00eb84.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847a7f34128-2f5f-457a-a14d-21cafc00eb84.tmp
                                        • Size 1KB
                                        • SHA256 02cec81cf8ba7c9a42953e675019ec8f081f03c9265c19f0b8de5da12844f43b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847ac6f4a16-7440-4d45-9267-05977c5e38f4.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847ac6f4a16-7440-4d45-9267-05977c5e38f4.tmp
                                        • Size 1013B
                                        • SHA256 ca7e7f0576173c735aaba2a492398bce5efea219fb54983979106cc5af2dfde9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847b11df4fb-4134-4c73-abdb-4a78c5bd19df.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847b11df4fb-4134-4c73-abdb-4a78c5bd19df.tmp
                                        • Size 645B
                                        • SHA256 5013aec5497cf4932a8882e68a6e11082c94a50a90e7b712a92fb6563ace1894
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847b3fbdabb-8ef7-4dad-9466-f3f6d4d88860.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847b3fbdabb-8ef7-4dad-9466-f3f6d4d88860.tmp
                                        • Size 1KB
                                        • SHA256 42473d40a55b662e61032cdba9cf3ec42a055bfed4fd3dafad22b6d543e0ea92
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847bd1648a3-b8e2-4b41-a1b3-15c28a544cd9.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847bd1648a3-b8e2-4b41-a1b3-15c28a544cd9.tmp
                                        • Size 914B
                                        • SHA256 8f72f57b052ab6d0e29c6519a5ad57ab48c248f78e86cdc63df7014f121c0455
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847be38c7b3-73f9-4bb6-aa9c-e8e637e2e08b.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847be38c7b3-73f9-4bb6-aa9c-e8e637e2e08b.tmp
                                        • Size 1KB
                                        • SHA256 d571d7d2711e54a4bbeb7c53faa5c351afad6f0cc9621491368de1e2f7a1a56d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847be43be46-bfaf-4601-88f9-79aaa6dc9503.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847be43be46-bfaf-4601-88f9-79aaa6dc9503.tmp
                                        • Size 3KB
                                        • SHA256 1c8da5e44124ee9b10b3cc3f13511d239249c1aa28b6343766b9b4b117d27f23
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847bf2512dc-bea5-470c-817a-8cae33a97807.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847bf2512dc-bea5-470c-817a-8cae33a97807.tmp
                                        • Size 3KB
                                        • SHA256 b406321043e1f2948269e273b5f72256b2e17eefbe0c26399ab4d444307d22f1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847d7ea8804-5489-49a5-980b-d26fe3aefa82.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847d7ea8804-5489-49a5-980b-d26fe3aefa82.tmp
                                        • Size 818B
                                        • SHA256 8bf95352e9dbac02dcbe277abbf11496af759f83d2bff0b6967fb46b38e0b90a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.0.658573847e020fd44-016f-43ff-b79b-fd9ac30d03ed.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.0.658573847e020fd44-016f-43ff-b79b-fd9ac30d03ed.tmp
                                        • Size 3KB
                                        • SHA256 b1d780840bdf690104f9a9446b78dc4861b4f003a127606a00cfbb2eb32e4a64
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.1.848884980
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.1.848884980
                                        • Size 200B
                                        • SHA256 3c630db1bafacc2e8d1172327b4f84e14137b10970f01baacf73744550537873
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.1.848884980
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.1.848884980
                                        • Size 171B
                                        • SHA256 2093cc57956a82731661edccc4838b8a0c66e11dec34ab843679901f60d2ca6e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ssdfp6944.1.848884980cd7e7219-c145-4b47-b01e-5c6e694275d9.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6944.1.848884980cd7e7219-c145-4b47-b01e-5c6e694275d9.tmp
                                        • Size 224B
                                        • SHA256 c8ab0edf30a2b82f49347935a8d263fd3a78d1034d278a1c8c13e37beacf6ce8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        suggestions_cache.jsone60cd7ac-3672-4775-a082-65324fcf152a.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\suggestions_cache.jsone60cd7ac-3672-4775-a082-65324fcf152a.tmp
                                        • Size 652KB
                                        • SHA256 1781a667edd359d553316ee2375d4e3988b56eb46d8f53c0c08f94b09fc3aabe
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        data_1
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\GrShaderCache\data_1
                                        • Size 264KB
                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Local State1280b1ed-e865-4d99-94c0-35ceb4803a71.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State1280b1ed-e865-4d99-94c0-35ceb4803a71.tmp
                                        • Size 3KB
                                        • SHA256 5d00003be08353aa32305294a3dab2e84f6dab8b1bb0cfb2c3984dc99663cda7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Local State9656f750-96df-459c-902a-a05051e11bfe.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State9656f750-96df-459c-902a-a05051e11bfe.tmp
                                        • Size 4KB
                                        • SHA256 4f6fb2e7e2af5d372f5158838009a9f393de0827007a9b8762d669c7d5cfc597
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local Statebd827ed2-9ea4-4d90-af30-5f6116baff22.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local Statebd827ed2-9ea4-4d90-af30-5f6116baff22.tmp
                                        • Size 5KB
                                        • SHA256 608bf3443f88ebf2123ee6f0e60f404be9059f9a9c77da6b0e934d1539990adc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        VariationsSafeSeedV2bbeb8fec-0127-4982-bbbb-632e7c8f79cc.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSafeSeedV2bbeb8fec-0127-4982-bbbb-632e7c8f79cc.tmp
                                        • Size 19B
                                        • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        VariationsSeedV21c580489-5d78-40c8-b492-e786cfcd21fa.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSeedV21c580489-5d78-40c8-b492-e786cfcd21fa.tmp
                                        • Size 11B
                                        • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        clipboard_injection_guard_rules.json
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\clipboard_injection_guard_rules.json
                                        • Size 6KB
                                        • SHA256 b8d84b82da3d90323de6cf1b4e3594bf7acb99101c72379b10f4b982f82bd487
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        metadata.json4671cba1-50c0-455e-af4d-0f60376bd4d7.tmp
                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\extensions_crx_cache\metadata.json4671cba1-50c0-455e-af4d-0f60376bd4d7.tmp
                                        • Size 13B
                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        manifest.json
                                        • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6944_1312483988\manifest.json
                                        • Size 202B
                                        • SHA256 8bd59f33a6e286c7e7352dfaebc9b03cea4e0e959a8ebb2f04b69bd92e107dc1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        opera-one.jpg
                                        • Path C:\Windows\SystemTemp\scoped_dir6944_1888694606\opera-one.jpg
                                        • Size 194KB
                                        • SHA256 2e8375c8ba1c0f5379de54bf4bcb0af7ae0ef3c2a6af07409c8d007ff0685b71
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        persona.ini
                                        • Path C:\Windows\SystemTemp\scoped_dir6944_1888694606\persona.ini
                                        • Size 207B
                                        • SHA256 7cd803353a8af5af891ddf63908e408d1667cfc4b4d2882c61a0fe734df919ec
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        opera-one-dark.jpg
                                        • Path C:\Windows\SystemTemp\scoped_dir6944_19690837\opera-one-dark.jpg
                                        • Size 349KB
                                        • SHA256 70b35d024405f6adfb37715e58cadeefab36e305158a73e8a4cc377bae1a4476
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        persona.ini
                                        • Path C:\Windows\SystemTemp\scoped_dir6944_19690837\persona.ini
                                        • Size 217B
                                        • SHA256 69feb09a5aa11d2badb4cdf17c2ddf7861a97a1d3a6add0ded22e5e9e07defc5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        memory/824-1833-0x00000295A63B0000-0x00000295A63DF000-memory.dmp
                                        Download

                                        memory/1004-2751-0x000001E438DA0000-0x000001E438DCF000-memory.dmp
                                        Download

                                        memory/1768-2746-0x00000138E5700000-0x00000138E572F000-memory.dmp
                                        Download

                                        memory/2100-2749-0x00000214DEB20000-0x00000214DEB4F000-memory.dmp
                                        Download

                                        memory/2164-2748-0x00000251F2A60000-0x00000251F2A8F000-memory.dmp
                                        Download

                                        memory/2420-2762-0x000001D797340000-0x000001D79736F000-memory.dmp
                                        Download

                                        memory/2468-2734-0x00000184AC100000-0x00000184AC12F000-memory.dmp
                                        Download

                                        memory/2656-2745-0x0000029927450000-0x000002992747F000-memory.dmp
                                        Download

                                        memory/3124-2737-0x0000021D1E4F0000-0x0000021D1E51F000-memory.dmp
                                        Download

                                        memory/3304-2733-0x000001DD36550000-0x000001DD3657F000-memory.dmp
                                        Download

                                        memory/3744-2764-0x000002018CB30000-0x000002018CB5F000-memory.dmp
                                        Download

                                        memory/3864-2750-0x00000257DDAE0000-0x00000257DDB0F000-memory.dmp
                                        Download

                                        memory/4368-2665-0x000002050CAE0000-0x000002050CB0F000-memory.dmp
                                        Download

                                        memory/4508-2761-0x000001C774160000-0x000001C77418F000-memory.dmp
                                        Download

                                        memory/4572-2736-0x0000016EE48C0000-0x0000016EE48EF000-memory.dmp
                                        Download

                                        memory/4604-2765-0x000001FFF4930000-0x000001FFF495F000-memory.dmp
                                        Download

                                        memory/4852-2763-0x00000140C3D70000-0x00000140C3D9F000-memory.dmp
                                        Download

                                        memory/4860-2747-0x000002201F4A0000-0x000002201F4CF000-memory.dmp
                                        Download

                                        memory/5388-2982-0x0000013A3BC70000-0x0000013A3BC9F000-memory.dmp
                                        Download

                                        memory/5532-2902-0x000001D33F9E0000-0x000001D33FA0F000-memory.dmp
                                        Download

                                        memory/5584-1890-0x000002208BB00000-0x000002208BB2F000-memory.dmp
                                        Download

                                        memory/5584-573-0x00007FF99A830000-0x00007FF99A831000-memory.dmp
                                        Download

                                        memory/5584-574-0x00007FF9995A0000-0x00007FF9995A1000-memory.dmp
                                        Download

                                        memory/5704-2735-0x0000024709530000-0x000002470955F000-memory.dmp
                                        Download

                                        memory/5856-1831-0x0000026113140000-0x000002611316F000-memory.dmp
                                        Download

                                        memory/6352-2752-0x000001EAFFD30000-0x000001EAFFD5F000-memory.dmp
                                        Download

                                        memory/6488-2766-0x0000023906150000-0x000002390617F000-memory.dmp
                                        Download

                                        memory/6568-2988-0x00000249B0460000-0x00000249B048F000-memory.dmp
                                        Download

                                        memory/6744-2756-0x0000024ED5C90000-0x0000024ED5CBF000-memory.dmp
                                        Download

                                        memory/6828-1832-0x0000020AA0C20000-0x0000020AA0C4F000-memory.dmp
                                        Download

                                        memory/6932-2789-0x000001DFD81A0000-0x000001DFD81CF000-memory.dmp
                                        Download

                                        memory/7220-2662-0x000001DD93250000-0x000001DD9327F000-memory.dmp
                                        Download

                                        memory/7248-2664-0x000002B4DBC60000-0x000002B4DBC8F000-memory.dmp
                                        Download

                                        memory/7308-2669-0x0000020508090000-0x00000205080BF000-memory.dmp
                                        Download

                                        memory/7312-2666-0x0000021D86A70000-0x0000021D86A9F000-memory.dmp
                                        Download

                                        memory/7320-2667-0x000001D295370000-0x000001D29539F000-memory.dmp
                                        Download

                                        memory/7328-2670-0x0000020081500000-0x000002008152F000-memory.dmp
                                        Download

                                        memory/7344-2668-0x000001DBD0CF0000-0x000001DBD0D1F000-memory.dmp
                                        Download

                                        memory/7732-2867-0x000001A0BFF70000-0x000001A0BFF9F000-memory.dmp
                                        Download

                                        memory/8216-3330-0x0000010D894A0000-0x0000010D894CF000-memory.dmp
                                        Download

                                        memory/8484-3024-0x0000025CB6C40000-0x0000025CB6C6F000-memory.dmp
                                        Download

                                        memory/8828-3034-0x0000017A74A80000-0x0000017A74AAF000-memory.dmp
                                        Download

                                        memory/8860-3084-0x000001F9C3A60000-0x000001F9C3A8F000-memory.dmp
                                        Download

                                        memory/8916-2757-0x000001CF4BE30000-0x000001CF4BE5F000-memory.dmp
                                        Download

                                        memory/9168-3193-0x000001598A5D0000-0x000001598A5FF000-memory.dmp
                                        Download