Overview

overview

8

Static

static

8

OperaInstaller.exe

windows10-2004-x64

8

OperaInstaller.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    200s
  • max time network
    194s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 12:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OperaInstaller.exe
  • Size 178KB
  • Sample261027-pr2hes1x2p
  • SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\OpInst.exe
      "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=NjgxZTJkZmFjMWM4MjZkYmFlMmRkYzFlNWU1Yjc5Y2EyMTlmZTdmYjIwODc3ODI2NzFjNGFjMmI2YTAxNDFhYjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJ0aW1lc3RhbXAiOiIxNzkzMTA0NDg4LjYxOTMiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoidmlkZW8tc3RyZWFtaW5nIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJ3cmsifSwidXVpZCI6IjYwYWRlOTRmLWQwZTYtNDk4OS1iMjVjLTE3NGI5YzYzMmJjYyJ9
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Enumerates connected drives
        • Reads the TCP/IP host and domain name from the registry
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff647564258,0x7ff647564268,0x7ff647564278
          4⤵
          • Executes dropped EXE
          PID:2576
        • C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\installer.exe" --version
          4⤵
          • Executes dropped EXE
          PID:5828
        • C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4992 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_20261027123450" --session-guid=855ad5b1-33f3-4298-b583-18f6e04d2390 --server-tracking-blob="OTNmNGIyY2Y5NjRmMjY4YmVkOTNhZTEzMjU2YjY1ZjI0YzUyNGVmMmZiMWE5MDVlYmU0MTZhOTliNTdjZTFmYTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTMxMDQ0ODguNjE5MyIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJ2aWRlby1zdHJlYW1pbmciLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiNjBhZGU5NGYtZDBlNi00OTg5LWIyNWMtMTc0YjljNjMyYmNjIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1808000000000000
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Suspicious use of WriteProcessMemory
          PID:4116
          • C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x2ac,0x2b0,0x2c0,0x288,0x2c4,0x7ff647564258,0x7ff647564268,0x7ff647564278
            5⤵
            • Executes dropped EXE
            PID:2036
          • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\installer.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\installer.exe" --backend --initial-pid=4992 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501" --session-guid=855ad5b1-33f3-4298-b583-18f6e04d2390 --server-tracking-blob="OTNmNGIyY2Y5NjRmMjY4YmVkOTNhZTEzMjU2YjY1ZjI0YzUyNGVmMmZiMWE5MDVlYmU0MTZhOTliNTdjZTFmYTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3OTMxMDQ0ODguNjE5MyIsInVzZXJhZ2VudCI6Ik9wZXJhIEluc3RhbGxlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJ2aWRlby1zdHJlYW1pbmciLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiNjBhZGU5NGYtZDBlNi00OTg5LWIyNWMtMTc0YjljNjMyYmNjIn0= " --silent --desktopshortcut=1 --install-subfolder=139.0.6053.15
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1464
            • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\installer.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x2b4,0x2b8,0x2bc,0x294,0x2c0,0x7ff778414258,0x7ff778414268,0x7ff778414278
              6⤵
              • Executes dropped EXE
              PID:4704
            • C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes a Windows system DLL name to a user directory
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of WriteProcessMemory
              PID:484
              • C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xdac9cc,0xdac9d8,0xdac9e4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:792
              • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:4828
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x36c9cc,0x36c9d8,0x36c9e4
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1980
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:3360
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:4344
                    • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                      10⤵
                      • Executes dropped EXE
                      PID:2556
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:2708
                    • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                      10⤵
                      • Executes dropped EXE
                      PID:4412
                  • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x2a0,0x2a4,0x2a8,0x24c,0x2ac,0x1047324,0x1047330,0x104733c
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5984
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:1952
                      • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                        11⤵
                        • Executes dropped EXE
                        PID:5560
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:1508
                      • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                        11⤵
                        • Executes dropped EXE
                        PID:5528
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:4760
                      • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                        11⤵
                        • Executes dropped EXE
                        PID:4516
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\de932af914ba00303d4a2778a383ac9c831101e2.crx"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2696
              • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                7⤵
                • Executes dropped EXE
                PID:5184
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1904,i,2326253930235267105,12093120399874164513,524288 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2204 /prefetch:11
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                PID:368
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1676,i,10489877037706805771,17999670357791906180,262144 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2092 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:2132
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2512,i,12952769271212912568,16159085278813559895,524288 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2396 /prefetch:13
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:2172
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,1142125123900463579,4550666091919747967,1572864 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3264 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5280
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4232,i,9610152734395836883,2156822128166383631,524288 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4280 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1908
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4452,i,8721085420720762134,14174395110261550518,1572864 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4468 /prefetch:9
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1636
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3016,i,7009907145880472472,17368490878949581085,524288 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3960 /prefetch:12
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:1132
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5012,i,6270234727305088819,12369048650788248856,524288 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5024 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:1040
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5000,i,12394276277953018696,13841363785538091109,524288 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5140 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:5508
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5304,i,13036870632346926682,313791927433176868,1572864 --field-trial-handle=2096,i,10657223258527755651,15012147894962149087,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2100,i,1776433307339525042,7927878510956683732,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5280 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:6872
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:6892
              • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x1f0,0x278,0x27c,0x240,0x280,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                7⤵
                • Executes dropped EXE
                PID:7008
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1700,i,18176057313321432127,9419272023819729253,262144 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2036 /prefetch:2
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:6188
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1928,i,2290926136186626547,12993449268684440782,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2076 /prefetch:11
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                • Enumerates system info in registry
                PID:3396
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2500,i,4609530058821915462,152904196596497419,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2720 /prefetch:13
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:7024
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2992,i,6296440421781000211,5816274893918495360,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3132 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:7084
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3004,i,13326127222318051898,98583893144023336,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3168 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:7004
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3044,i,574793696052692236,13137270642430278125,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3236 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:7116
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2816,i,1642941278876926525,14062773577139605415,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3112 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:7124
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3028,i,16654338103491832,17424774758963340857,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3212 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:7152
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3016,i,144738827672815885,12561865950409235454,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3188 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:7160
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3056,i,7725018990760371561,15292322154018315164,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3260 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:1652
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3440,i,8078843772515823049,15908045351630522001,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3144 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6536
              • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_gx_splash.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C96
                7⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:6800
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4788,i,2036457405270166377,11496796532330648623,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4804 /prefetch:9
                7⤵
                • Executes dropped EXE
                PID:5572
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4952,i,1647589496102978921,11784448793998746865,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4976 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:5480
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5160,i,11677364423725117775,10715700385148093130,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5184 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6576
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4944,i,1321339814083157751,13848075727804617028,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5360 /prefetch:1
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6684
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6188,i,14102445924038653925,9737905206512942166,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6208 /prefetch:9
                7⤵
                • Executes dropped EXE
                PID:6720
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6836,i,851805635631582070,6029115457614064311,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6924 /prefetch:9
                7⤵
                • Executes dropped EXE
                PID:6124
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6768,i,3160410039000585764,4060870317830435575,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6904 /prefetch:9
                7⤵
                • Executes dropped EXE
                PID:432
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6748,i,16134820973638637048,4408620095245211217,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6544 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:3216
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5612,i,11662121716147963115,6020620319251471290,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5340 /prefetch:14
                7⤵
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:6968
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3424,i,1613771797312616979,6397792947103782973,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7156 /prefetch:14
                7⤵
                • Enumerates system info in registry
                PID:6776
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6608,i,4025404430716657620,9971566790949281511,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6832 /prefetch:14
                7⤵
                  PID:6828
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6568,i,5582701208647759903,4128844359155442798,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6840 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:6812
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6184,i,1248689451965354932,6981447474374672617,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6588 /prefetch:14
                  7⤵
                  • Enumerates system info in registry
                  PID:5072
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7764,i,9773243516832368410,15739959790059570576,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7568 /prefetch:14
                  7⤵
                    PID:6736
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7996,i,10875629659137254416,13064148393468348827,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8048 /prefetch:14
                    7⤵
                    • Enumerates system info in registry
                    PID:6688
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8012,i,7419635129557163514,18101486264816460120,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8088 /prefetch:14
                    7⤵
                      PID:5592
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8028,i,8839913800737125983,7610894812184787070,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8128 /prefetch:14
                      7⤵
                      • Enumerates system info in registry
                      PID:6780
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8036,i,10739242848383693981,1702185110742193272,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8148 /prefetch:14
                      7⤵
                        PID:4280
                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8020,i,7448610271299547231,190260388688849458,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8108 /prefetch:14
                        7⤵
                          PID:3832
                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8004,i,858998322662100931,9720635971369448842,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8068 /prefetch:14
                          7⤵
                            PID:4640
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8748,i,6790054993297026723,10234065660853659251,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8780 /prefetch:14
                            7⤵
                            • Enumerates system info in registry
                            PID:2388
                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8316,i,1475592002534699091,14268908127720271470,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8760 /prefetch:14
                            7⤵
                              PID:2132
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9052,i,12896201766058173772,9741596747750719592,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8840 /prefetch:12
                              7⤵
                              • Enumerates system info in registry
                              PID:3052
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9200,i,5799387639004173705,152470298956628910,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9220 /prefetch:9
                              7⤵
                              • Enumerates system info in registry
                              PID:6988
                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9400,i,13738347928710027923,11978071460830744477,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9396 /prefetch:14
                              7⤵
                                PID:5728
                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9544,i,7536398337160478997,6771575556876118441,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9432 /prefetch:14
                                7⤵
                                  PID:6148
                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7800,i,15454976515858559793,15395026443578332844,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9692 /prefetch:14
                                  7⤵
                                    PID:860
                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7828,i,9781301009434397050,15604357081691763189,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=9880 /prefetch:1
                                    7⤵
                                    • Enumerates system info in registry
                                    PID:1708
                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9244,i,10760983172387530895,4176081735979666519,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=9240 /prefetch:14
                                    7⤵
                                      PID:6400
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10280,i,15770992652944792432,16442492454475681637,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=3068 /prefetch:14
                                      7⤵
                                      • Enumerates system info in registry
                                      PID:7480
                                    • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                      "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F161
                                      7⤵
                                      • Reads the TCP/IP host and domain name from the registry
                                      • Enumerates system info in registry
                                      PID:8476
                                      • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                        C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff70ff4bde8,0x7ff70ff4bdf8,0x7ff70ff4be08
                                        8⤵
                                          PID:8744
                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=10660,i,1127260590211291816,5741486024632262955,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10740 /prefetch:1
                                        7⤵
                                          PID:8652
                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8768,i,8805080661571774093,11882019019037388952,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=7924 /prefetch:14
                                          7⤵
                                          • Enumerates system info in registry
                                          PID:9204
                                        • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                          "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7836,i,4366730680221691826,10677624588087067371,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=8784 /prefetch:14
                                          7⤵
                                            PID:2108
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4296,i,11364014505873750849,8218365735653850547,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=3156 /prefetch:14
                                            7⤵
                                            • Enumerates system info in registry
                                            PID:7276
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1680,i,6459246106639776656,14048771119083134194,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=3752 /prefetch:14
                                            7⤵
                                            • Enumerates system info in registry
                                            PID:7568
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3564,i,2992733758010388312,18269754687071664100,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=7768 /prefetch:14
                                            7⤵
                                            • Enumerates system info in registry
                                            PID:7616
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3812,i,6485566691152174328,4495130793127871461,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=3820 /prefetch:14
                                            7⤵
                                            • Enumerates system info in registry
                                            PID:7604
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4160,i,10410031645795864764,16209076457115036593,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=3972 /prefetch:14
                                            7⤵
                                            • Enumerates system info in registry
                                            PID:7220
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10700,i,8023633124329242411,15584543299846683552,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=3436 /prefetch:14
                                            7⤵
                                            • Enumerates system info in registry
                                            PID:7456
                                          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10728,i,14836901694267347548,13626965867371996350,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=3924 /prefetch:14
                                            7⤵
                                              PID:7684
                                            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=8028,i,4770888922199950593,14561794616975269228,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=10632 /prefetch:9
                                              7⤵
                                                PID:7796
                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8152,i,11693520394315219200,15470121233519364436,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=8636 /prefetch:14
                                                7⤵
                                                • Enumerates system info in registry
                                                PID:6792
                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8404,i,16583369029235618409,12297529989524534045,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=8380 /prefetch:14
                                                7⤵
                                                • Enumerates system info in registry
                                                PID:8724
                                              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7328,i,6681967150883764210,3996170450880002158,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=7320 /prefetch:14
                                                7⤵
                                                  PID:8792
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6252,i,5965833363205380341,12850572272356307985,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=8692 /prefetch:14
                                                  7⤵
                                                  • Enumerates system info in registry
                                                  PID:8868
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=9624,i,6864908968447330262,14189182472869011735,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=6660 /prefetch:9
                                                  7⤵
                                                  • Enumerates system info in registry
                                                  PID:2800
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8096,i,13311790123001073753,11665310146463248864,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=7988 /prefetch:9
                                                  7⤵
                                                    PID:4280
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=9180,i,3700458134905832561,11878805820212536483,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=9220 /prefetch:1
                                                    7⤵
                                                    • Enumerates system info in registry
                                                    PID:7180
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3832,i,12219226269356439760,16329675813223703896,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=7512 /prefetch:14
                                                    7⤵
                                                      PID:824
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8744,i,4082708416446065799,15997324449118914281,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=8796 /prefetch:14
                                                      7⤵
                                                      • Enumerates system info in registry
                                                      PID:1896
                                                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=7636,i,13594690454872764795,12874074979064549163,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=3936 /prefetch:9
                                                      7⤵
                                                        PID:7056
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8160,i,1991222614174929818,15362553707205577390,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=8624 /prefetch:14
                                                        7⤵
                                                        • Enumerates system info in registry
                                                        PID:2216
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=8560,i,1871255889836115086,9004290947079987947,262144 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=8048 /prefetch:10
                                                        7⤵
                                                        • Network Service Discovery
                                                        • Enumerates system info in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5076
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=5032,i,4004346415872542123,13022786907548366893,1572864 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=4916 /prefetch:9
                                                        7⤵
                                                        • Enumerates system info in registry
                                                        PID:720
                                                      • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:cashback-extended-messaging=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5152,i,11411054603510691272,7655163503560114724,524288 --field-trial-handle=2040,i,6756268337447248922,14110664427099432169,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,CanvasDrawElement,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,507147251789975064,928560097262063627,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=8144 /prefetch:14
                                                        7⤵
                                                          PID:8948
                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Writes a Windows system DLL name to a user directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3016
                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe" --version
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2376
                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xdac9cc,0xdac9d8,0xdac9e4
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4764
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                                              1⤵
                                                PID:3296
                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                1⤵
                                                  PID:4524
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4780
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe
                                                    C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffb1e236a40,0x7ffb1e236a50,0x7ffb1e236a60
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:4668
                                                • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC1
                                                  1⤵
                                                  • Reads the TCP/IP host and domain name from the registry
                                                  • Enumerates system info in registry
                                                  PID:8484
                                                  • C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe
                                                    C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.15 --initial-client-data=0x294,0x298,0x29c,0x22c,0x2a0,0x7ff70ff4bde8,0x7ff70ff4bdf8,0x7ff70ff4be08
                                                    2⤵
                                                      PID:8996
                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
                                                      2⤵
                                                        PID:8680
                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
                                                      1⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2920
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                      1⤵
                                                        PID:7704

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            DLL Search Order Hijacking

                                                            1
                                                            T1574.001

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            DLL Search Order Hijacking

                                                            1
                                                            T1574.001

                                                            Defense Evasion

                                                            Hijack Execution Flow

                                                            1
                                                            T1574

                                                            DLL Search Order Hijacking

                                                            1
                                                            T1574.001

                                                            Masquerading

                                                            1
                                                            T1036

                                                            Match Legitimate Name or Location

                                                            1
                                                            T1036.005

                                                            Modify Registry

                                                            2
                                                            T1112

                                                            Credential Access

                                                            Credentials from Password Stores

                                                            1
                                                            T1555

                                                            Credentials from Web Browsers

                                                            1
                                                            T1555.003

                                                            Unsecured Credentials

                                                            1
                                                            T1552

                                                            Credentials In Files

                                                            1
                                                            T1552.001

                                                            Discovery

                                                            Network Service Discovery

                                                            1
                                                            T1046

                                                            Peripheral Device Discovery

                                                            1
                                                            T1120

                                                            Query Registry

                                                            5
                                                            T1012

                                                            System Information Discovery

                                                            4
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Network Configuration Discovery

                                                            1
                                                            T1016

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Data from Local System

                                                            1
                                                            T1005

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Size 471B
                                                            • SHA256 4bb8bbb8179a94f2268a6f6c5cc0ddf5a58de522b78d9b4711dd6654d5569884
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                                                            • Size 416B
                                                            • SHA256 809e69ee640dc634008ab2095c366033c7f686efd44e1d4b47fc2e1788e441d9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            snapshot-new.baf
                                                            • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\Cache\No_Vary_Search\snapshot-new.baf
                                                            • Size 20B
                                                            • SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            f_000001
                                                            • Path C:\Users\Admin\AppData\Local\Opera Software\Opera Stable\Default\System Cache\Cache_Data\f_000001
                                                            • Size 164KB
                                                            • SHA256 7b34b52894bc775da2501928ff7a6bfac91e81470f00de304cb867a0824f96bc
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            139.0.6053.15.manifest
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\139.0.6053.15.manifest
                                                            • Size 225B
                                                            • SHA256 aa9685fbdf8220c3b079a2ba1a492232b5fa430ee2b227cf6ecbf8a372f3404b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-100.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-100.png
                                                            • Size 1KB
                                                            • SHA256 56bcd46dcfae3147a8b8b3d00ee5041dad4655e83a7e829bf637377c96538643
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-100_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-100_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 3829dbefe8bd528be268f3181a902e1fe78883eb8f8aac679c9985c2ad13c6b9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-140.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-140.png
                                                            • Size 1KB
                                                            • SHA256 2637072751e1e6398c45d2c5b22c54adadfbbd4d3007238799f5da63f846167b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-140_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-140_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 ce3559b2efd6d547fb822440690cfbf793eb70c98154ad4dbf3a7c0e1af5e166
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-180.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-180.png
                                                            • Size 1KB
                                                            • SHA256 7ca510381079a4b166e9d5fcf0dc005d9606197e8636621b655d6459941139a0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-180_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-180_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 f7eb888cd9bce4641fcb01088b05be242f616dc06c3f823e51fb63b53b6f14f5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-80.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-80.png
                                                            • Size 827B
                                                            • SHA256 f287370ff8c7e2ba120407cafe09c1fce674ae8af5bd5fcc0c2dd1c6628b9ce9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            150x150Logo.scale-80_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\150x150Logo.scale-80_contrast-white.png
                                                            • Size 799B
                                                            • SHA256 0a9129bde051c17e96e516d5bc509e1a06a1e066a5e2796627cbef8630002b47
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-100.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-100.png
                                                            • Size 781B
                                                            • SHA256 fb5662c5fde7d49862da2e0253ae03dc7e5f9afd2edc65d4efa6dc3a3026156f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-100_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-100_contrast-white.png
                                                            • Size 752B
                                                            • SHA256 3fa9dfc982544f3ffda0795beec69c65d6c5883be0de37133466e643b5f3aeea
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-140.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-140.png
                                                            • Size 991B
                                                            • SHA256 84f8ebb629791e0b73cd53d7f3445d685145d0787a207e25842b237c98a8c99a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-140_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-140_contrast-white.png
                                                            • Size 865B
                                                            • SHA256 99cd2b5809ab9c604613b305bc80e6f68b858c1289c07e84aadabc4c3768ff32
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-180.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-180.png
                                                            • Size 1KB
                                                            • SHA256 c5d33ee3b5e8dcb9e9aeae5f14d0e92cf9bdc16d6245ce65dd4340c8a0be4f26
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-180_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-180_contrast-white.png
                                                            • Size 1KB
                                                            • SHA256 e5112331e0e2684ffb5adc0ac23324d9836cf067111f1f5834c77b1153a8a5d7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-80.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-80.png
                                                            • Size 590B
                                                            • SHA256 91ba72309e34c5336c09b8f5c787a6327082f275d5d7bfe491c5430e67c80752
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            70x70Logo.scale-80_contrast-white.png
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\Assets\70x70Logo.scale-80_contrast-white.png
                                                            • Size 519B
                                                            • SHA256 37b0f1fb4a08af8a42e6d8fce4c7380ddae0272150d7a9bb8b1d138066a9ffbe
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            assistant_package
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\assistant_package
                                                            • Size 4.0MB
                                                            • SHA256 03dd636098b19ec3aeab3650d9dba877077655efe2e16514e13a9480b7c9494d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            d3dcompiler_47.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\d3dcompiler_47.dll
                                                            • Size 4.5MB
                                                            • SHA256 4d9ff78db3a96e095612e60562022bd4baab49e5da4fcf719bd476e38ef6759c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dxcompiler.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\dxcompiler.dll
                                                            • Size 24.7MB
                                                            • SHA256 9f8471b88a586052082b00c5da1fc0800761414e345fda6d5bd52def8a0a06c6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            files_list
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\files_list
                                                            • Size 7KB
                                                            • SHA256 ae279d6170c8dcff14622584e44e56c63ea07d44dc577ad13c6b0f7400322987
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            headless_command_resources.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\headless_command_resources.pak
                                                            • Size 3KB
                                                            • SHA256 0ee35aeeb7c9a7beb89664639100c70320f1164f0266b1d1ae91b8e6a3237398
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            icudtl.dat
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\icudtl.dat
                                                            • Size 10.4MB
                                                            • SHA256 113f7464a507af4f7d2b0ea73094217881386f19dac7cacc5f071e7a4cf04a20
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer.exe
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\installer.exe
                                                            • Size 8.6MB
                                                            • SHA256 bdc04b806365a8931ad39fce26d8f9da97ec0ea00d0d2a3e177050e8f1e99533
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer_helper_64.exe
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\installer_helper_64.exe
                                                            • Size 617KB
                                                            • SHA256 d9a65f777e162eb699c39336617101de808f4ef590377316c5f1222d1c6f1a4f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            libEGL.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\libEGL.dll
                                                            • Size 455KB
                                                            • SHA256 3ec08ea6ff06a1f7a987afd43b21ec45794dc64db98060d3df271f50865d5deb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            libGLESv2.dll
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\libGLESv2.dll
                                                            • Size 455KB
                                                            • SHA256 bceae0a50f9c32f3eceb27c64abdfc363cde8a3eb98fbad711c7af0c1f384eb1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            bg.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\bg.pak
                                                            • Size 988KB
                                                            • SHA256 80a9bad85236d58a9e62c6a228e60a61e57e6ede338b000c09f178d4aa75c383
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            bn.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\bn.pak
                                                            • Size 1.2MB
                                                            • SHA256 e2b95cfba880dd2961bd5e3336da98a6559159ced9cf0856b9c424bbffd0d767
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ca.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\ca.pak
                                                            • Size 622KB
                                                            • SHA256 f7fff280841c8c55da719ca8ac0231e89a196f952a47b4c731e0bb7ec665fd5c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cs.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\cs.pak
                                                            • Size 622KB
                                                            • SHA256 9fba306678907ee2abb0cb8b30b71bd148e15e871433212202d06bbb41981b71
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            da.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\da.pak
                                                            • Size 571KB
                                                            • SHA256 dde4d78dc36d52b17607a1620ab194e643355db9c0ab0dc8b20c9974e779d945
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            de.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\de.pak
                                                            • Size 620KB
                                                            • SHA256 238bbf904ba8158db8faf1a55eeff46fafa397ccd883a5395dafc4dd781d519e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            el.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\el.pak
                                                            • Size 1.1MB
                                                            • SHA256 01e19b79df72aace4f56749e49580d416611fbed646a5e987d1034addb2166f6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            en-GB.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\en-GB.pak
                                                            • Size 501KB
                                                            • SHA256 f3655830866f3ae25c6eaaf67245a9121ca95dc11741bd50c01456373e2465eb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            en-US.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\en-US.pak
                                                            • Size 505KB
                                                            • SHA256 e595945a75aae5f8207c4fe76f47fa3d8421798bb0b830b8694cdf90acce3e4f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            es-419.pak
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\139.0.6053.15\localization\es-419.pak
                                                            • Size 611KB
                                                            • SHA256 d82e9d7a028ed3b87afd78463423461379bbcf32a9cfba01da9d337409abc810
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer_prefs.jsond83ee45f-22b9-4f49-888a-e734298ce6f2.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.jsond83ee45f-22b9-4f49-888a-e734298ce6f2.tmp
                                                            • Size 1KB
                                                            • SHA256 9c9b060047f59e3cf8af406db5c99dbd1fb078ce1b2a9340adc6e32f8f8ad5cc
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Opera Browser.lnk
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\Opera Browser.lnk
                                                            • Size 1KB
                                                            • SHA256 f54d1dea712ac1741899a72d55a7ec34526ed1841a899a66ae9205da480e9929
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Assistant_136.0.6008.52_Setup.exe_sfx.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe
                                                            • Size 2.9MB
                                                            • SHA256 30786977e61add36f7c641facfb7fce1b2ec7c2a0a7e055a172f127a68788556
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            assistant_installer.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\assistant_installer.exe
                                                            • Size 2.4MB
                                                            • SHA256 e8dce277d6edb918499526fadba9902e317496c2af077219f263a7a643467824
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dbgcore.DLL
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\dbgcore.DLL
                                                            • Size 196KB
                                                            • SHA256 c16220edd3787da33dbd3ac2fcbec7de6a13e2baf14ae6105bba68d4efd83628
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dbghelp.dll
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\assistant\dbghelp.dll
                                                            • Size 1.8MB
                                                            • SHA256 990b13e88b4a9985eb5c596078e2ec26a0edcc22169dd71f8a84c7943005306c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            de932af914ba00303d4a2778a383ac9c831101e2.crx
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\de932af914ba00303d4a2778a383ac9c831101e2.crx
                                                            • Size 3.5MB
                                                            • SHA256 9d645b0ce032688d4f3100cd1f1d178d3c2c9d04bb691144659b98b4931d8eef
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            installer_prefs_include.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\installer_prefs_include.json
                                                            • Size 228B
                                                            • SHA256 fb510f9f3decb14b00aa8a87149dbbdd4286ee684cce0fab0c996d15aa67d4a6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            installer_prefs_include.json618e64a0-3b73-4357-8b00-8879d67a6ba5.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\installer_prefs_include.json618e64a0-3b73-4357-8b00-8879d67a6ba5.tmp
                                                            • Size 1KB
                                                            • SHA256 345a8273d261be1c67b2f62a63f55997363e0ee4d3f0398ee200851deca45a70
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            installer_prefs_include.jsonc0dde75b-a752-42b3-9c4a-8c1464737c5d.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\.opera\070ab3cf-af38-490a-8ddc-d7b0ba65e0d0 Opera Installer Temp\opera_package_202610271234501\installer_prefs_include.jsonc0dde75b-a752-42b3-9c4a-8c1464737c5d.tmp
                                                            • Size 243B
                                                            • SHA256 bb34cce4e4c695d363965ea84f9ddc9cb30ce8ee95bcef6140f159be43969430
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            installer.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\7zS0A59CEC9\installer.exe
                                                            • Size 8.6MB
                                                            • SHA256 5bf753fbc15ece38e159a21970a38fce2c3a66cfda8900f956da07c5ef62775a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OpInst.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                                                            • Size 3.2MB
                                                            • SHA256 f68b762a4c9b51e5147d27b69e359cf61e667e35ee2d1ba1c9bed5849a4a3174
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            bg.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\bg.png
                                                            • Size 224KB
                                                            • SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            favicon_opera_one.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_331637656\CRX_INSTALL\favicon_opera_one.png
                                                            • Size 2KB
                                                            • SHA256 44ee468b888578da502658d7f2b05b24d9034756701f49d762b00615f8da62f3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_331637656\CRX_INSTALL\manifest.json
                                                            • Size 3KB
                                                            • SHA256 04dbe0c15af570ccff856c4bb005419e343ba39092eaeda1116b91a8e5961523
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            reader_mode.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_331637656\CRX_INSTALL\reader_mode.js
                                                            • Size 112KB
                                                            • SHA256 ebb002d9d7d9206bc39d3f44bae6e49b7d694a172a0b1da9934f49c17f433084
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            service_worker.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_331637656\CRX_INSTALL\service_worker.js
                                                            • Size 1.1MB
                                                            • SHA256 055406577738ff3eac762b7d2e7360bac21acf0bb688d829d0acfb9126993de2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            spotify_frame_interceptor.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_331637656\CRX_INSTALL\spotify_frame_interceptor.js
                                                            • Size 5KB
                                                            • SHA256 f25cc540e5212f9f327bfb16702e156d385aa2545bd1b4c572f6a5543d4e7930
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            icon-128.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1152022129\CRX_INSTALL\assets\icon-128.png
                                                            • Size 9KB
                                                            • SHA256 8a909845237ef287d26ee417ab15fa924b0c16351f5b31dea656940bf09111f2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            icon-16.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1152022129\CRX_INSTALL\assets\icon-16.png
                                                            • Size 654B
                                                            • SHA256 8e6ff8ab8b4dedec067b7cb06d5f4dcad566d1174430f5e5156be4c196e6af66
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            icon-32.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1152022129\CRX_INSTALL\assets\icon-32.png
                                                            • Size 1KB
                                                            • SHA256 7bafbbc53c7baf9cad8e417945ceff6298b6316dfd89f213f68accd888076aac
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            icon-512.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1152022129\CRX_INSTALL\assets\icon-512.png
                                                            • Size 46KB
                                                            • SHA256 2f0ef2b9ecaf5773ec985141a2020497348eb77e71fc852e5823313adddd96ed
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            icon-64.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1152022129\CRX_INSTALL\assets\icon-64.png
                                                            • Size 4KB
                                                            • SHA256 69d4bdc94e86a99d29d0d78300b246d08f4957b957cd81d400a2cff2ed815477
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1222082315\CRX_INSTALL\_locales\en\messages.json
                                                            • Size 396B
                                                            • SHA256 1bcb4888a65788a50ed88f4bd95955d1dafdc950b5ef4609b37f42934a4bf3b9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1222082315\CRX_INSTALL\icons\128\Icon_Light_Neutral.png
                                                            • Size 2KB
                                                            • SHA256 ec33dffd3fdb927141385a8c8eefb5fdfbd6dec9b50dfa02d66aa6377342bce2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_1222082315\CRX_INSTALL\icons\32\Icon_Light_Neutral.png
                                                            • Size 962B
                                                            • SHA256 e8adb8a9dcca121a1853749ebef122b84a995ebf8775cd27b0dd54bab9840bd1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_128.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_248959083\CRX_INSTALL\public\icons\logo_128.png
                                                            • Size 7KB
                                                            • SHA256 ff6b16ff9fe66e48327c79530b73e1953d911ef7c2ce52aef5a25449c4dd501c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            logo_16.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_248959083\CRX_INSTALL\public\icons\logo_16.png
                                                            • Size 653B
                                                            • SHA256 0a9f9a6fe9f00c19e1f0989047226e811017316aaec8b872cb52303e06921dad
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_32.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_248959083\CRX_INSTALL\public\icons\logo_32.png
                                                            • Size 1KB
                                                            • SHA256 84cda3736c90c8468ec808c52ac01a4876f7b6bafeae0bf9448fd93a5007e2cb
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_48.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_248959083\CRX_INSTALL\public\icons\logo_48.png
                                                            • Size 2KB
                                                            • SHA256 0e34bf5a8a832b9e43211ca1fef8a05c0be60c9cbdbd8fd7a451d71e78905b73
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            logo_64.png
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6892_248959083\CRX_INSTALL\public\icons\logo_64.png
                                                            • Size 2KB
                                                            • SHA256 60f672b50db19a619d76522a46ecf0c13080ee469f62b191d0636c94cc5dc7b3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                            • Size 40B
                                                            • SHA256 97cf82092f1c45df2375e3fd10a07a1c1bb8d2f7af1db4b5a609525081160138
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            BookmarkMergedSurfaceOrdering6245ad05-0f18-4faf-9da8-14c06285c348.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarkMergedSurfaceOrdering6245ad05-0f18-4faf-9da8-14c06285c348.tmp
                                                            • Size 6B
                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            BookmarksExtras2310e7cb-166b-499d-964e-cbbe68d34c31.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\BookmarksExtras2310e7cb-166b-499d-964e-cbbe68d34c31.tmp
                                                            • Size 223KB
                                                            • SHA256 8ec7a056aaf7acc36eeeaad2c563f129dfe4a68e7d913f8d526677d764abaff8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Bookmarkse55ce612-ea10-4519-9396-695f7d613c47.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Bookmarkse55ce612-ea10-4519-9396-695f7d613c47.tmp
                                                            • Size 34KB
                                                            • SHA256 f9526da6f9786062d1c21cc3b9834db1feb404fa0e65bb56375dd205c1f78255
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
                                                            • Size 336B
                                                            • SHA256 d4ce2884af2f83c7e56719530df2d6017a1761ad6cbcc1932884b65b79b04afa
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\temp-index
                                                            • Size 1KB
                                                            • SHA256 cd05b4e9a2ed809d4da4c34506a78ff12ea5c40c0429a960f469ce1efa1ba9ca
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 48B
                                                            • SHA256 5def06b5654dd4ee39fd8ff6849d90c35ec27b92d7b5055224ea7dec327528cf
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            data_0
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_0
                                                            • Size 8KB
                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_1
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_1
                                                            • Size 264KB
                                                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_2
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_2
                                                            • Size 8KB
                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_3
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\DawnGraphiteCache\data_3
                                                            • Size 8KB
                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            main.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\enegjkbbakeegngfapepobipndnebkdk\1.4.9_0\main.js
                                                            • Size 48KB
                                                            • SHA256 c2d961a8340848930aa0b7141ec03b973639d119756904d35fc8efe1a4cb8ec7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            scraping-method-Dq4mm50p.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\scraping-method-Dq4mm50p.js
                                                            • Size 6KB
                                                            • SHA256 99c8d4f76ebc9fc6cea115065570a12d41903c93e18c1c6385b5b2e70256eb70
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            service-worker.ts-fle0M1Xd.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\assets\service-worker.ts-fle0M1Xd.js
                                                            • Size 13KB
                                                            • SHA256 4ebb6cb9c3f033302d6a8c31329009082bafeab73c39cca179511b5a972ba8f8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            service-worker-loader.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ijcflbogjpkmfhbbikopgkcojpdaldjm\1.0.8_0\service-worker-loader.js
                                                            • Size 49B
                                                            • SHA256 ebb831521006d7c846c68d66e583693f364d4e5d5214d2363e3ef6e78988f2a3
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            icon-32.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\keffaafdbbkncgpoonkimdinpffobgoa\1.1.5_0\assets\icon-32.png
                                                            • Size 1KB
                                                            • SHA256 92a8f864ce76af0bc1dc7fd186589d464b1f696a35d10bd94fcef5d0db608661
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\_locales\en\messages.json
                                                            • Size 429B
                                                            • SHA256 c6a7161359e3c4fbc4059b7209c585f9aa2306c08e6c39a3003f4b29f2ceb22d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            background.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\background.js
                                                            • Size 105KB
                                                            • SHA256 9a9b0f7b3070d6f47773e487ebf53134c7629c15c4564ca613c3c9a8077b543d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            content.js.LICENSE.txt
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\content.js.LICENSE.txt
                                                            • Size 1KB
                                                            • SHA256 f10ea2db0cc0b4c4a316d6a4fb23dd6e2f19f5eb215fdbfd1709d7f2c233df8c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Active.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Active.png
                                                            • Size 2KB
                                                            • SHA256 97d9553a4f725354a6d5c3eff11f31285fd89c3b150593f04785b83d0a56efc2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Red.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Available_Red.png
                                                            • Size 2KB
                                                            • SHA256 9eccebdbdb61efc0cbd8bccf3a5fedc6f9a1ebe5084b160783f90a56cd1efa7b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Yellow.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Available_Yellow.png
                                                            • Size 2KB
                                                            • SHA256 c165ef60bf3806cd0a7121a8d6cfd06909fc84b38a07d43e809bd7bff564099c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\128\Icon_Light_Neutral.png
                                                            • Size 2KB
                                                            • SHA256 219a18e24c4050669e1c65581aa55807aeddbe9169d13db3421b1f1bad8508c1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Active.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Active.png
                                                            • Size 883B
                                                            • SHA256 50aa1dcfa9083b57dd6187752b2c149294210be12d263b793d27daf8d431954c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Red.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Available_Red.png
                                                            • Size 895B
                                                            • SHA256 2278e95b28851ade57217ab5c7b32598c44e1085693a3e26379643d29fa0a6d1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Available_Yellow.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Available_Yellow.png
                                                            • Size 895B
                                                            • SHA256 726a50a9c008449ab7bafbf21325bfc72093b7ae6a56c5be90cf8c32a8a44641
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Icon_Light_Neutral.png
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\icons\32\Icon_Light_Neutral.png
                                                            • Size 932B
                                                            • SHA256 b8e92f9e9b9dc82799231b8d1b57091a9d0bcdd9b54615f86e8c4e4e5c9f036b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index.html
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\index.html
                                                            • Size 222B
                                                            • SHA256 fd21c7ca4637b0221250a14b9fcfb6ebc3b734e659ad80151be4bc579db818f1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            rules.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Extensions\ompjkhnkeoicimmaehlcmgmpghobbjoj\4.1.87.1062_0\rules.json
                                                            • Size 839B
                                                            • SHA256 2693069fe851c816f327b4cd2c5ff1bd11024b04033df827330a6fcb48cb1bf6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            2589a532-e22d-46e0-b950-fa2531ec41a1.tmp7d2e70f6-84b3-44c5-90a6-143e49310acd.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\2589a532-e22d-46e0-b950-fa2531ec41a1.tmp7d2e70f6-84b3-44c5-90a6-143e49310acd.tmp
                                                            • Size 27KB
                                                            • SHA256 b8f0a6164e126d0f70798a96f456487080b5473bee571bb9594600f8a53901c7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            662d0e68-2aa1-42d1-b496-1d0897ee8181.tmpfccbeea8-b3a3-4740-bdca-b076ffc081ad.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\662d0e68-2aa1-42d1-b496-1d0897ee8181.tmpfccbeea8-b3a3-4740-bdca-b076ffc081ad.tmp
                                                            • Size 27KB
                                                            • SHA256 f79057f51183f6efa9c93c2a864f9a4165992119cf38c938cff219619aefe2d2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            6ffdf24c-33b5-4bed-8dc9-9bd8e610be6b.tmp8cbb4d92-63ac-4162-a627-3d9c40aef6f9.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\6ffdf24c-33b5-4bed-8dc9-9bd8e610be6b.tmp8cbb4d92-63ac-4162-a627-3d9c40aef6f9.tmp
                                                            • Size 27KB
                                                            • SHA256 72472b74d71f2ca964413f18fc6078d80f1de88af5ddfe1d45098ab37d69421e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            be9cadd0-2460-481f-9474-632faaea0651.tmpfc046704-c2d5-43e8-a9f4-f25a818f4e3d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\be9cadd0-2460-481f-9474-632faaea0651.tmpfc046704-c2d5-43e8-a9f4-f25a818f4e3d.tmp
                                                            • Size 27KB
                                                            • SHA256 09b4f9a23cfa587b071052ac7cd4803139d3f1775a11b4c552b92472d857f460
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            cba91223-175c-44f5-80ab-eb888893575d.tmp3bc6b5e2-8672-4511-80c7-e6ad1ed8a91d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\cba91223-175c-44f5-80ab-eb888893575d.tmp3bc6b5e2-8672-4511-80c7-e6ad1ed8a91d.tmp
                                                            • Size 27KB
                                                            • SHA256 24683ea67b7b390d33c1d607fc44a309989ada5a9fa5fb4ec96a96fda96d44ff
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            d860a28f-6089-40f9-829f-8ca816dccebf.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Jump List Icons\d860a28f-6089-40f9-829f-8ca816dccebf.tmp
                                                            • Size 27KB
                                                            • SHA256 1b6cb01715a2de1373f9f3e194921621463532558767bb5d6e1902e9b368ca5c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Network Persistent State4fbce412-fd81-4a87-8881-687e9b65b06e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent State4fbce412-fd81-4a87-8881-687e9b65b06e.tmp
                                                            • Size 1KB
                                                            • SHA256 f37dab5f3ad0c75117ef0e7aaa7fb73db6602c5e0bf3e9687945e40c9f6b145f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Network Persistent Stateeb9ce1f4-59e2-4d48-ac7d-ac3f0eef7b6a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\Network Persistent Stateeb9ce1f4-59e2-4d48-ac7d-ac3f0eef7b6a.tmp
                                                            • Size 111B
                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SCT Auditing Pending Reports
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Network\SCT Auditing Pending Reports
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Preferences2f4cf04b-60c0-4278-bbb2-9322791817e4.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences2f4cf04b-60c0-4278-bbb2-9322791817e4.tmp
                                                            • Size 16KB
                                                            • SHA256 01b90f6b0f7aa25293ff721c7ebf00e830415b7388fc641a5abda831e8f358bb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences878b2add-11d7-45cb-a16e-805e332ba55c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences878b2add-11d7-45cb-a16e-805e332ba55c.tmp
                                                            • Size 15KB
                                                            • SHA256 b2cb388a8b3e2da0dbf17d8a5ebf26fac72652102b055b641614e8bafcf65475
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences8941a558-a522-42d2-a08c-7d6da27c20df.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferences8941a558-a522-42d2-a08c-7d6da27c20df.tmp
                                                            • Size 10KB
                                                            • SHA256 c96d26134b1ae5a5f19cc3aa07ea801b30061eaec30be6e391fa5068fb699f9f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferencesa13b0f16-4c19-4204-9a08-4591faa7cdd6.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Preferencesa13b0f16-4c19-4204-9a08-4591faa7cdd6.tmp
                                                            • Size 15KB
                                                            • SHA256 6c13630bf7ffb2045ede785a5bf14e4c27bb202b01a3e30874f2492ca9fa9556
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Secure Preferences80a99df3-3009-462a-a831-14a2af389246.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferences80a99df3-3009-462a-a831-14a2af389246.tmp
                                                            • Size 112KB
                                                            • SHA256 f9b5cbc39680639a9207c024c6a5145b9a7e94eb778ad7273f76f0cfa391459a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Secure Preferencesae44af37-d005-43c6-983f-47d4c844808d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Secure Preferencesae44af37-d005-43c6-983f-47d4c844808d.tmp
                                                            • Size 82KB
                                                            • SHA256 1839d820906b3a3632a0b507caf90f89f6e40dc08d72601b1cace4419dbea922
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                            • Size 96B
                                                            • SHA256 8c7895013970f620548c37622cfb6695b53b606679e0a58b44517f5041a91195
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            temp-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                            • Size 456B
                                                            • SHA256 d6277d0e060ffa876afac151cdea0ac32b7fba76aecb14b75b329c2685f1fc1a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                            • Size 72B
                                                            • SHA256 725f3c57f71c4304e3b51dabd2f7188ec4deb6302b85d5c62298154e92525a8d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                            • Size 72B
                                                            • SHA256 1819a3c0214501064869487b95a256e81daea89bcad10cbc6dfe86e3e23d5ef5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            index
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Shared Dictionary\cache\index
                                                            • Size 24B
                                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            CURRENT
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Site Characteristics Database\CURRENT
                                                            • Size 16B
                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw
                                                            • Size 12KB
                                                            • SHA256 664ef698f73c0be8ce98e43043224330ef9f43b0151af3454a55839b0300c00f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw
                                                            • Size 14KB
                                                            • SHA256 d85cf7d8050c635d56c7749392d6be51822827be80d4df39d82aa12232b9bce0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw
                                                            • Size 381B
                                                            • SHA256 6e862b8cb3a4e57481b5731b7d1b18ad537d93ab8e3c1c51ee466e6538f012ab
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw0224de82-96c7-4440-8286-12cbbdec1f55.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw0224de82-96c7-4440-8286-12cbbdec1f55.tmp
                                                            • Size 13KB
                                                            • SHA256 600db7b139892797889d0a1ecd89f0c89630538f5ab2c6c2f6711774b8b4fb21
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw02accac4-8012-44d8-aa60-185b7665705e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw02accac4-8012-44d8-aa60-185b7665705e.tmp
                                                            • Size 14KB
                                                            • SHA256 bb10546214edce121b1b3a98aea214421ce8a92a1192455f527e972ef7cf6576
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw0bb47cdb-5c71-4aa8-89f7-6b0ab1638f94.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw0bb47cdb-5c71-4aa8-89f7-6b0ab1638f94.tmp
                                                            • Size 8KB
                                                            • SHA256 55b1e09a75f9e16e503e2fe40a6c0b2207522b374e2bba1b50dc7890f936efb9
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw10976087-1b62-4a63-9398-3ae1ad827228.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw10976087-1b62-4a63-9398-3ae1ad827228.tmp
                                                            • Size 11KB
                                                            • SHA256 faa9bf4a73d3d4d1df3a69310ec341730b9910d0c8f5f9f639072a7c01d75f39
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw12be8136-40a0-4cf2-9242-0e48f5b88b08.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw12be8136-40a0-4cf2-9242-0e48f5b88b08.tmp
                                                            • Size 10KB
                                                            • SHA256 db83385e49cd36335c2165116e4c04ca97156f23367213790ebcee3edfddb3d6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw16646493-66a8-4283-abee-1dad187b1f7c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw16646493-66a8-4283-abee-1dad187b1f7c.tmp
                                                            • Size 10KB
                                                            • SHA256 13e6718c498fda7774dbc47e22bcfdd55c24719df34251347690633f953e91c0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw18239041-f005-420e-97a2-1bcb8fde9811.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw18239041-f005-420e-97a2-1bcb8fde9811.tmp
                                                            • Size 10KB
                                                            • SHA256 d40f360f9f7360e9e88c8cc3b035b196d9703911a15c8009b9e88383156d1015
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw19febbba-a391-47d1-b890-205451573221.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw19febbba-a391-47d1-b890-205451573221.tmp
                                                            • Size 9KB
                                                            • SHA256 6b5d27d4708bd209897512c1c770de98ec32382256a0c87fd3c1aba1cd156cde
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1b78898e-9c1d-42a9-8f4b-afdfbefc185f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1b78898e-9c1d-42a9-8f4b-afdfbefc185f.tmp
                                                            • Size 14KB
                                                            • SHA256 5c89783bbcb66a8752136c53a4843d23fde60287f0e8c94879824a76030e8fa1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1bcd60ce-8530-4679-9e82-932ed9b2b2e7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1bcd60ce-8530-4679-9e82-932ed9b2b2e7.tmp
                                                            • Size 8KB
                                                            • SHA256 fe4987f6ad82df2a2d63668d39290b67e839b6d848978bb8d7640db1951e037f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1d16b45b-f0e5-4e97-953d-d865e2a630c9.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1d16b45b-f0e5-4e97-953d-d865e2a630c9.tmp
                                                            • Size 14KB
                                                            • SHA256 61503ce7243ef962b2ab5367b78ffb0f8962f219c3ed779989214cef7057e650
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1e547bac-422b-428a-9717-2088095b25de.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw1e547bac-422b-428a-9717-2088095b25de.tmp
                                                            • Size 9KB
                                                            • SHA256 54e55c57f1b181c4e93f86ad2107a9606caeb4258ec25964e00338a8d5447ed5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw21837f5a-bef2-4cf3-83e3-aed387fa5e77.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw21837f5a-bef2-4cf3-83e3-aed387fa5e77.tmp
                                                            • Size 2KB
                                                            • SHA256 b6efb0b09f3df9b888d1fb958cc83b3e4b87225286958dd55646607e323fd1ae
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw22ee295d-d9e2-42e5-ab93-80d26f20ce93.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw22ee295d-d9e2-42e5-ab93-80d26f20ce93.tmp
                                                            • Size 14KB
                                                            • SHA256 84629155ed04fa6a11b933d66e84402e604529bc2829e46d98d1b27fe0567032
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw233c321d-ecf1-4419-b519-c794099ae15f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw233c321d-ecf1-4419-b519-c794099ae15f.tmp
                                                            • Size 13KB
                                                            • SHA256 8fc4a5642529ef39ec21f7851a626548cb564c9a82b973701f799cc64a651774
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw24c64172-0d5c-44a0-a397-d78487eecebb.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw24c64172-0d5c-44a0-a397-d78487eecebb.tmp
                                                            • Size 13KB
                                                            • SHA256 c9f4652b65aebe76f359e9f008f7c30341d7a577702de82b3ec67ba302d44985
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw2a31bec4-8700-4a90-a712-e52eb6e4c170.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw2a31bec4-8700-4a90-a712-e52eb6e4c170.tmp
                                                            • Size 12KB
                                                            • SHA256 484786aa3ce8f6bac9f98ba7c8796ef6a1182eb4d03a8cd1a2410f34c4065bb0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw2c7345b4-ac77-4060-8939-cef37db68de6.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw2c7345b4-ac77-4060-8939-cef37db68de6.tmp
                                                            • Size 621B
                                                            • SHA256 8cdd7a784d8e3b7b9bc926002bbb197fad059cfd71d3c051218366e5a4425947
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw2e69b61b-34b2-4b38-9ec8-30d3b17649f8.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw2e69b61b-34b2-4b38-9ec8-30d3b17649f8.tmp
                                                            • Size 14KB
                                                            • SHA256 232f9d723d9a68ca4c483d8ca4e90196cdb89923b76b83e71f00e40546693b8e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw31544195-104b-4ad5-b232-fc0484a3c86b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw31544195-104b-4ad5-b232-fc0484a3c86b.tmp
                                                            • Size 925B
                                                            • SHA256 589f1087114f9a28e9272cd82653a26650d6fd5ef74ca6c0f6901801a271579f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw337efde6-b6ad-49b1-b784-c0b45276362d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw337efde6-b6ad-49b1-b784-c0b45276362d.tmp
                                                            • Size 3KB
                                                            • SHA256 d0cdfe384287c1b67b090bbe87dfb1d5423f789e907e8ed9bd2237cec8e001b0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw346f941a-1a25-41c5-bb09-863857702a7b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw346f941a-1a25-41c5-bb09-863857702a7b.tmp
                                                            • Size 13KB
                                                            • SHA256 9a12e69681100a104d98eac04f68253120fda6d87d9b68114867adf834820595
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw358e5032-8bde-4bc0-881c-fd80251aef08.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw358e5032-8bde-4bc0-881c-fd80251aef08.tmp
                                                            • Size 973B
                                                            • SHA256 0e7ff11c32f49a026086111b59dbf27329cf1dabcd20fc319ad4583c7bb1b1c2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw364b6e35-2ee0-42bd-887a-931aba06774d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw364b6e35-2ee0-42bd-887a-931aba06774d.tmp
                                                            • Size 749B
                                                            • SHA256 b1441d36b4dd0de3d9cf3f46c7eb4fd74e9b39c7730da54a822cdf079636d99d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw3933dc07-1c86-44d8-8218-070856049295.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw3933dc07-1c86-44d8-8218-070856049295.tmp
                                                            • Size 11KB
                                                            • SHA256 e857fb09b5294afad1a81320a988aa52d605ea5ff7c1a80eece4193469715e09
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw3cf3565b-3b60-4898-b9a9-d26338123c0a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw3cf3565b-3b60-4898-b9a9-d26338123c0a.tmp
                                                            • Size 12KB
                                                            • SHA256 8de77157737cddc220ecab0d2b371f6084a9cd1d83fc3bb750233f7ecae7fe8c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw3f7bae43-f0fe-4986-bfbd-55b994f6c76a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw3f7bae43-f0fe-4986-bfbd-55b994f6c76a.tmp
                                                            • Size 11KB
                                                            • SHA256 cc74199275719d96d8533d34372c1fa7cefc51845f6909cf3dc6da8fd02675d5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw45e855d8-4e2d-417e-bd90-6323574d27df.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw45e855d8-4e2d-417e-bd90-6323574d27df.tmp
                                                            • Size 12KB
                                                            • SHA256 0396d12105c07bd6d1bb699e20e0ea96cf0d72199cb5926e275c339e33c0154e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4978fd7d-c651-4f89-9cb7-9c6fcff0b6a1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4978fd7d-c651-4f89-9cb7-9c6fcff0b6a1.tmp
                                                            • Size 3KB
                                                            • SHA256 9f8792600260a048599e7584d60cc13bb75846f9a6cb73046b767d7eb860f683
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4d62896d-308c-4d4c-923a-d7e42c61f384.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4d62896d-308c-4d4c-923a-d7e42c61f384.tmp
                                                            • Size 9KB
                                                            • SHA256 573992fad28d18d8d50984fbc755c5aa2474c9fa672627ba56bbec90a4454f09
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4dcb2afd-2b07-443c-a144-083ce00cc50f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4dcb2afd-2b07-443c-a144-083ce00cc50f.tmp
                                                            • Size 13KB
                                                            • SHA256 124eced68630f8dd33745c0f2dffe28e26358881b5e130eb2e8c981645c38395
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4ea028ec-f8a3-4270-88f4-486f4626ab02.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw4ea028ec-f8a3-4270-88f4-486f4626ab02.tmp
                                                            • Size 8KB
                                                            • SHA256 18adc673d818f813fa47d870cd49f88015888b27463b5c108b59c2ed7ce5b9d3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw53125815-bfac-4fa4-8c98-f41a45317066.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw53125815-bfac-4fa4-8c98-f41a45317066.tmp
                                                            • Size 9KB
                                                            • SHA256 7ef4516294b0067faaafd0f6bce7d45a1076253d3f7980d74f3bd22a4aaaf859
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw540a4b59-aa56-4b14-852a-91a4d99e0478.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw540a4b59-aa56-4b14-852a-91a4d99e0478.tmp
                                                            • Size 13KB
                                                            • SHA256 b4468cfbfece82aed2e9f41f0406be876c05e1e1e0f45a7ae65af45b60ed118c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw5445431e-ccf3-42ca-ac15-44d9e3e1d18c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw5445431e-ccf3-42ca-ac15-44d9e3e1d18c.tmp
                                                            • Size 11KB
                                                            • SHA256 71264126a2c193b31e3bed4faf657a1fce5493cd96b3b9c7337dcfa0a69659a6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw5506c597-941c-4158-b96c-1d5ca0375c1c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw5506c597-941c-4158-b96c-1d5ca0375c1c.tmp
                                                            • Size 10KB
                                                            • SHA256 2734ab51bcd7c955faa94f1be927a259c185bbb23c71b814fa0bc333b2be4a3a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw5ecbb33d-2875-4db4-90d1-c94ce155085e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw5ecbb33d-2875-4db4-90d1-c94ce155085e.tmp
                                                            • Size 14KB
                                                            • SHA256 0e98c92f7b1df86c2e59ecd93c9bfeb33b747f70db7c855ee8612edebd313a31
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw649281da-57d3-4442-856a-934601ccea8d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw649281da-57d3-4442-856a-934601ccea8d.tmp
                                                            • Size 8KB
                                                            • SHA256 09aabc0501156c8e987b62128e6c796ab3d31732352914296f1f59d47e105fc2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw67886b4d-75ac-4326-bbfe-6020c39d9d0c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw67886b4d-75ac-4326-bbfe-6020c39d9d0c.tmp
                                                            • Size 12KB
                                                            • SHA256 c120fc3fbd82c48a891e249b6c6f430b997cc24b6703c6b4ae1ed2028c1c117d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw6c0b10b6-29f8-4ab1-98ef-2cd4b1e52ad3.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw6c0b10b6-29f8-4ab1-98ef-2cd4b1e52ad3.tmp
                                                            • Size 13KB
                                                            • SHA256 ef7638e843ad449efe1f26750083d2eb4037d5afaee836e0f54fcd7a0e6fabbc
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw7789f08a-b833-497d-bb1e-c99885c61c0b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw7789f08a-b833-497d-bb1e-c99885c61c0b.tmp
                                                            • Size 2KB
                                                            • SHA256 64e94f8bce897718fad0a120868103783ac7eaef3d232e923f059f74c4e1b6fd
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8266ed43-1565-40db-a1ef-3a29cc6fcfb3.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8266ed43-1565-40db-a1ef-3a29cc6fcfb3.tmp
                                                            • Size 13KB
                                                            • SHA256 54021ee78bbddecd6fcfd1fabbbee6126e8221ab82fedc0980e49bceb552cd2c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw827e93de-e58f-4f59-94be-65df3fa3363e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw827e93de-e58f-4f59-94be-65df3fa3363e.tmp
                                                            • Size 493B
                                                            • SHA256 d280688de3fb4b1c95de1bdcc3f55e3e3a5b1d4af5b2aaa3be4421e1eb50fb8b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw837d74f6-337d-4602-ba60-69aeac58f998.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw837d74f6-337d-4602-ba60-69aeac58f998.tmp
                                                            • Size 9KB
                                                            • SHA256 4a094360d9153a79091e13189f6b580f25c20200f15fd54229ce757a0c8d2951
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw83edf430-cff6-44e1-a481-007e4ba8f9c4.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw83edf430-cff6-44e1-a481-007e4ba8f9c4.tmp
                                                            • Size 2KB
                                                            • SHA256 ef7f4dacca1ec338b40a8abed09fefffe285c0e2fde17e419d9eeeff18beb087
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8a4ad5be-e4db-4cc6-a963-6fc8f8e9a0b8.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8a4ad5be-e4db-4cc6-a963-6fc8f8e9a0b8.tmp
                                                            • Size 8KB
                                                            • SHA256 e761a3a5b23dd7c3e09d1b840866a46f0080c743f3ef3daf52067801a5b22d3b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8ac146f4-b904-41ad-8e97-7c1c571e1c8b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8ac146f4-b904-41ad-8e97-7c1c571e1c8b.tmp
                                                            • Size 14KB
                                                            • SHA256 3e90da2e7819aa5f15226e6ffa0e2ef65a131ee4a63d65e9ac4ab0867da7cab0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8db3a918-6f9c-4fb2-802c-17d30afe3e1d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8db3a918-6f9c-4fb2-802c-17d30afe3e1d.tmp
                                                            • Size 2KB
                                                            • SHA256 b9e4ebfb0c56edb03ebf3c8a95c55852c395b4f93eca378a3422b99dbfa111cf
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8dc110cf-19c2-41e2-9853-6059101c06ed.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw8dc110cf-19c2-41e2-9853-6059101c06ed.tmp
                                                            • Size 14KB
                                                            • SHA256 3cda9e9118ffa61fab9d49b5300ac713299fb416a8e325bada0020f08460987d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw900df8f7-13ed-4dec-bdf9-4ba721b33d40.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw900df8f7-13ed-4dec-bdf9-4ba721b33d40.tmp
                                                            • Size 13KB
                                                            • SHA256 aa2111d22a2eacf86f722063aaa3477b325bb53900c8409c7a0950ea93855ecf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw90f58987-cc8b-4867-8192-7fc1718e0262.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw90f58987-cc8b-4867-8192-7fc1718e0262.tmp
                                                            • Size 1KB
                                                            • SHA256 b0486923fca0996b0736382a427e494f45008012741567cd4e398b2250fb65cb
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw9b448cb1-3060-4c28-8c9c-24dff2e941ac.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw9b448cb1-3060-4c28-8c9c-24dff2e941ac.tmp
                                                            • Size 9KB
                                                            • SHA256 f216a51692bc5c05c6b3a347d7bc62b3ba5dbbe6fdae724728ab4e64bb7de65f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw9df14a2e-24b3-4e22-8b95-49ec36acd7f7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raw9df14a2e-24b3-4e22-8b95-49ec36acd7f7.tmp
                                                            • Size 14KB
                                                            • SHA256 2d2fb663a46f8a005d495a782104e68feca9a24ab9b4b89ea67437ae9802c96a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa00e5d6f-97ea-48e2-807d-ac44a5c52963.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa00e5d6f-97ea-48e2-807d-ac44a5c52963.tmp
                                                            • Size 11KB
                                                            • SHA256 d0fa701a9d340f2f7280cf335204c10609c6bb21b4cfc4a52cc36b60adb6d884
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa0e75bcb-3ad0-41e3-b336-c7e704d961e2.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa0e75bcb-3ad0-41e3-b336-c7e704d961e2.tmp
                                                            • Size 14KB
                                                            • SHA256 dd9f3cc331a223fa9625e7d8551cf58946055df10da5cae9b7ceb75c56d192a0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa2e9979f-ad3a-49c5-9c8f-de3dd5eb7737.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa2e9979f-ad3a-49c5-9c8f-de3dd5eb7737.tmp
                                                            • Size 14KB
                                                            • SHA256 ce23bb9c4d5797e0da4b5f369c9fb4e80a5c30ade294a207b064edbc0d7466b8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa3688b95-d45e-4eae-b6fd-b76c0080cc16.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa3688b95-d45e-4eae-b6fd-b76c0080cc16.tmp
                                                            • Size 10KB
                                                            • SHA256 84dacd989a49eeb1188358f8c0fa4918e70d3b989d82fe7e001eee8f4c436dfb
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa70b0dfa-8508-417d-ac80-25f037918a76.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa70b0dfa-8508-417d-ac80-25f037918a76.tmp
                                                            • Size 12KB
                                                            • SHA256 5292e7da6b2e37da0207deaa9780b396f93909742ae3ba6ef39d1439b15e0382
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa807080d-6906-4454-b0be-68feb45a797e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa807080d-6906-4454-b0be-68feb45a797e.tmp
                                                            • Size 14KB
                                                            • SHA256 938c79e42d09bb4d9da38dc40f2241d0652c3509d970f5003e1129a52a49dc44
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa831ff2b-32ac-4206-996f-c965a337ba4c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawa831ff2b-32ac-4206-996f-c965a337ba4c.tmp
                                                            • Size 1KB
                                                            • SHA256 0bcf8a269ad6b88549ef87164fe39448f94456218b5e43c21c3deb544bab56b7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawad3fe685-ebee-41e6-9d1f-f525fb6de83c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawad3fe685-ebee-41e6-9d1f-f525fb6de83c.tmp
                                                            • Size 8KB
                                                            • SHA256 aa1304208e55556e52875210bb40782cdc8df2d4efcfbb655e1544eeaeda727c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawad84215a-e823-4b14-8010-dc08e8c7fa56.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawad84215a-e823-4b14-8010-dc08e8c7fa56.tmp
                                                            • Size 8KB
                                                            • SHA256 14c54ad3f7d8b6808c9b0dcc00a359b7f8081bf723b034de3c29b104814dc050
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawaf068c85-bf41-413d-b6c4-b562e55b5b53.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawaf068c85-bf41-413d-b6c4-b562e55b5b53.tmp
                                                            • Size 9KB
                                                            • SHA256 c54e1849d8292a6c25f94249468377eb8662f5f262893a6190d4c541c6ae8c55
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawb24bf173-c3a1-44e6-af54-13c640e60eca.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawb24bf173-c3a1-44e6-af54-13c640e60eca.tmp
                                                            • Size 9KB
                                                            • SHA256 60512f1d8dc43e892f6bcb78dab8042255579abcf830e255fe01db99badafc22
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawb8f1cf2d-37d5-4302-abc6-8e4c6f6e6c54.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawb8f1cf2d-37d5-4302-abc6-8e4c6f6e6c54.tmp
                                                            • Size 1KB
                                                            • SHA256 0324d674f0fe11b4de691a1cd2d6ccf4b27b65e3a665e29a0383eeaa51054670
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawb9af7973-9e1e-4848-9e8d-5a43d1e1ef88.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawb9af7973-9e1e-4848-9e8d-5a43d1e1ef88.tmp
                                                            • Size 9KB
                                                            • SHA256 a4ceac54bc219841a391e21d7da791ffc0e88c54ee802f867e4b19114d7c7f54
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc46010d8-1d9e-4441-946e-5a9e26530e16.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc46010d8-1d9e-4441-946e-5a9e26530e16.tmp
                                                            • Size 10KB
                                                            • SHA256 01d25b121f6e0200370ff32a286eef65d013aa315cff9da2fc0c6e3993a6a67d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc520f11f-b001-429d-8900-5ebab8384071.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc520f11f-b001-429d-8900-5ebab8384071.tmp
                                                            • Size 10KB
                                                            • SHA256 44c3ba83fdba786d89bbfd32743e9b8b8492879504143414bc5e89f4e6a00962
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc55d9a2e-4089-487f-88c7-8b72f23ce5d1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc55d9a2e-4089-487f-88c7-8b72f23ce5d1.tmp
                                                            • Size 1KB
                                                            • SHA256 4c05c9b64b7a89f3d603b37e81a75484fd82fd5e970303b3fb97cd84e702777c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc8c7567e-bd5b-4c22-be98-80f49d41a6bc.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawc8c7567e-bd5b-4c22-be98-80f49d41a6bc.tmp
                                                            • Size 2KB
                                                            • SHA256 ce57ea9bff51d83b5b22f798cfcd4567aca463cc0fb843df027b93c5169b5e04
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawd3f9e85a-4a7b-4c6e-a040-f6fdacbd6d24.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawd3f9e85a-4a7b-4c6e-a040-f6fdacbd6d24.tmp
                                                            • Size 1KB
                                                            • SHA256 41030b9664e10b3b88652c515642d0b56faaff30275d93d8ef3239c1eed94cd6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawda3bba05-66c8-4ad5-acb4-3d520f6a0107.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawda3bba05-66c8-4ad5-acb4-3d520f6a0107.tmp
                                                            • Size 3KB
                                                            • SHA256 de523f0ec17ac2b806ec301655546f479cfe92a7451faa29cf560a596c66c069
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawdb2ea156-355c-4685-87ba-c8f534b2440f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawdb2ea156-355c-4685-87ba-c8f534b2440f.tmp
                                                            • Size 13KB
                                                            • SHA256 97e9cf811641669f3695ad37d16f000cebd896a158ab5f894c9fa1403505819e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawde9544c9-830d-4a8b-97c3-4aa066ac4259.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawde9544c9-830d-4a8b-97c3-4aa066ac4259.tmp
                                                            • Size 9KB
                                                            • SHA256 fe4d5dc972f7a63610538588a36cd39987966c748771ebae2e83965721bee64a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe0a08823-0394-445f-a0df-5e37a662d0a5.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe0a08823-0394-445f-a0df-5e37a662d0a5.tmp
                                                            • Size 10KB
                                                            • SHA256 9b097b54e041aee6872fc2b0c387a3044ba1c739114abc2be1a9fbae32bf08bc
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe27a2443-ee12-43fe-83ed-9f0f9841bc8e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe27a2443-ee12-43fe-83ed-9f0f9841bc8e.tmp
                                                            • Size 9KB
                                                            • SHA256 a242187f5dda465a94b11c5b5b603da35a3c954d55ff586847529cc735de802a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe285d2fb-fa38-4b68-bffc-354c431e2714.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe285d2fb-fa38-4b68-bffc-354c431e2714.tmp
                                                            • Size 11KB
                                                            • SHA256 7fdf2ae3ce53547e48ae0272728a51f116f30978ad06b9e9a62c78288daee343
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe5de1ded-2b03-43d1-86a8-49dbf804922b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe5de1ded-2b03-43d1-86a8-49dbf804922b.tmp
                                                            • Size 13KB
                                                            • SHA256 2ffe3c42cbe7e7fc538e9329b57613d266b257ee378b9b4d51e0a9250805388c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe7f19744-4e44-4bff-bd3d-3d19ecd623da.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawe7f19744-4e44-4bff-bd3d-3d19ecd623da.tmp
                                                            • Size 11KB
                                                            • SHA256 c8063946d3e2a0e1c9239114c48ac60f76fba0160722473185c1fb5a0aba00f4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawea28fb2a-fb0d-4dc8-8e25-f57f699b108c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawea28fb2a-fb0d-4dc8-8e25-f57f699b108c.tmp
                                                            • Size 14KB
                                                            • SHA256 e23eb2914e5b54bed7aa7e7370af6354219b01dd215bcf57ec12f29360af1a41
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raweb534b27-539d-4735-99d7-708f80a84602.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raweb534b27-539d-4735-99d7-708f80a84602.tmp
                                                            • Size 1KB
                                                            • SHA256 54fd4cbd1dbc92f564a7bfee4274040402e887770383733eda5b6d6fdd7b5c6d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raweb648b5a-de74-49f9-834d-37479e4e08b7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.raweb648b5a-de74-49f9-834d-37479e4e08b7.tmp
                                                            • Size 1KB
                                                            • SHA256 9dc97591d971c7c42af218bdee7433386d47f7e54793e9092d4e7e5913c73591
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawf288c8c8-4ada-4a44-a651-87cdd5cfaacd.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawf288c8c8-4ada-4a44-a651-87cdd5cfaacd.tmp
                                                            • Size 10KB
                                                            • SHA256 0a5fda07fdfe59025c6aecc140dd0a54f247653d6c52360d53aa5cf274cc9698
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawf6254459-707b-435b-9389-21756b8e5da1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawf6254459-707b-435b-9389-21756b8e5da1.tmp
                                                            • Size 9KB
                                                            • SHA256 2881fb7d8bc700cd0eef4590f087b08a756839d859546a8bf42d97884ec0755b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawf703c6a9-c6a2-40fb-932e-b57432133b12.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawf703c6a9-c6a2-40fb-932e-b57432133b12.tmp
                                                            • Size 9KB
                                                            • SHA256 e75998648aaa3a25816bf8e9b717ef53b0be26a99ea77fe5d2bb391969f8d263
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawfc248a75-91ce-4cca-ae0d-d4173237aae3.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawfc248a75-91ce-4cca-ae0d-d4173237aae3.tmp
                                                            • Size 9KB
                                                            • SHA256 6fc0888d406f0046268dbc522b8dedfa1df3636fdb040aa9f56d6f90d3ef66e2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawfd03f355-b146-4e64-8baa-10186d920b78.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_73dcac51-33d1-4157-9dc3-8d8d8ec8f687.rawfd03f355-b146-4e64-8baa-10186d920b78.tmp
                                                            • Size 2KB
                                                            • SHA256 6c93506d3a4b99c1484c32ee30e65cc9625b9002e9edb8f2dd8f8c90c740cc13
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw
                                                            • Size 381B
                                                            • SHA256 13b45ba654722bfff27656b64d15e51ac13a4b1e7cf3503680a27b78fc647477
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw01a913aa-c257-445b-85ff-d061c29f6795.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw01a913aa-c257-445b-85ff-d061c29f6795.tmp
                                                            • Size 493B
                                                            • SHA256 043a68c72914025797654d32ac0ba9ffca915f74c881fc7341cc5f09249e90a1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw32a5342c-aa54-4fa8-9382-7ddfb1e2c366.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw32a5342c-aa54-4fa8-9382-7ddfb1e2c366.tmp
                                                            • Size 1KB
                                                            • SHA256 751b1526e44750cc888a0f8f4654bfff10a8c5ce56a71088bb62b2fff2b35eeb
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw39d8182d-eea8-4f2f-b529-2bcb4b0cb783.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw39d8182d-eea8-4f2f-b529-2bcb4b0cb783.tmp
                                                            • Size 1KB
                                                            • SHA256 42de8c9954d9c677cf1669f695ca572a6caaaf861370a7ac2e2b0f7ca153749f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw5343b3b7-ae2a-426d-829e-12679a38b5aa.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw5343b3b7-ae2a-426d-829e-12679a38b5aa.tmp
                                                            • Size 1KB
                                                            • SHA256 16abb3a40f02594a66012766ddd4a7e1e783be36984c1a23a460d8a262c48940
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw6e8601b1-157e-42c5-8eb8-e45fb74fb516.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw6e8601b1-157e-42c5-8eb8-e45fb74fb516.tmp
                                                            • Size 957B
                                                            • SHA256 5437b956ed2f89ab1be0316c054ad59b01b471b1634f1ba6c2d8719cdbd58578
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw84cdba0b-c60f-4c3a-8472-a67e75e8c00b.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw84cdba0b-c60f-4c3a-8472-a67e75e8c00b.tmp
                                                            • Size 781B
                                                            • SHA256 fbb476d1784db2f0fd931234628ded4c188b9e933b8f0ade2577fa7e8a0ec00a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.raw8cf1da3a-6641-40b8-afca-02ffe7a5570e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.raw8cf1da3a-6641-40b8-afca-02ffe7a5570e.tmp
                                                            • Size 797B
                                                            • SHA256 0d1b2ea0feaa0d49f25d6d547744a5ffdc39b62009b26728413cf5b27ced90f5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.rawa0db59fc-3805-40a1-b837-713dccb9d8c5.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.rawa0db59fc-3805-40a1-b837-713dccb9d8c5.tmp
                                                            • Size 1KB
                                                            • SHA256 61d13f2c1c34d42aa10098c12d51fa4c4e9cfb3d799eb42a4e0a1d69cf621d47
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.rawa2935afd-bc07-459c-9cd1-170610bcc4f5.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.rawa2935afd-bc07-459c-9cd1-170610bcc4f5.tmp
                                                            • Size 1KB
                                                            • SHA256 4133205349e0a859ef4f2cebf21ee8e2ed62ec9488e82c733d018fdaefd49e63
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.rawa80badf9-faef-4145-a382-379c2226f99d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.rawa80badf9-faef-4145-a382-379c2226f99d.tmp
                                                            • Size 605B
                                                            • SHA256 84ba3ba49010cd69b8d1b1db37b673ef64b493e5be37bdcab155c45779473c26
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.rawc17b353f-c6d0-4392-b903-3e601a4523e0.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.rawc17b353f-c6d0-4392-b903-3e601a4523e0.tmp
                                                            • Size 797B
                                                            • SHA256 e63ebbd1772c7c186913a9a417ab5b035ec8a8240a9f3e7b8728fbb01dad1ecf
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            session_c203abeb-9384-4424-aca5-39a7d39a4304.rawdbbd176e-eaa8-4e33-aaed-06c3014ba87f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c203abeb-9384-4424-aca5-39a7d39a4304.rawdbbd176e-eaa8-4e33-aaed-06c3014ba87f.tmp
                                                            • Size 1KB
                                                            • SHA256 4f8eafaeaddcb8f1989ddbb5a75c7ec821594ac79777515253e50f150e9b9602
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            MANIFEST-000001
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Sync Data\LevelDB\MANIFEST-000001
                                                            • Size 41B
                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            rhs.dat
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\rhs.dat
                                                            • Size 113KB
                                                            • SHA256 ec48b44b406c128cefe7e1cd672b0290ee87d91e9ca01302b53f93d793e96b11
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ssdfp2696.0.521968650
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp2696.0.521968650
                                                            • Size 203B
                                                            • SHA256 cd62a9f49be9d0b3fa0694c2dec43f2366bd04de4cc5316359a64ce455179e05
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp2696.0.52196865002f74544-c162-426e-a9e2-427e2499421f.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp2696.0.52196865002f74544-c162-426e-a9e2-427e2499421f.tmp
                                                            • Size 265B
                                                            • SHA256 34e7a1753066575284043e4365d331274931791ef19bd8597ea8679e3fe44056
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp2696.0.5219686505f60e918-b0ef-4a1d-9466-6e626729935c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp2696.0.5219686505f60e918-b0ef-4a1d-9466-6e626729935c.tmp
                                                            • Size 1KB
                                                            • SHA256 98a2e4fd8b6fc390ff4f9c5a9a0cb38d028f3a8df521513f7fb3df5f8afb6637
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp2696.0.521968650aba3e204-e267-48bd-b224-12edf6a94a6e.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp2696.0.521968650aba3e204-e267-48bd-b224-12edf6a94a6e.tmp
                                                            • Size 1014B
                                                            • SHA256 d48aaaa5a899aaba46473ef968bac9d52c0ed1593c1856031cd8251b0f964509
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.747030983
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.747030983
                                                            • Size 401B
                                                            • SHA256 4c0ccb9bfefdb3ac6735fcebfa667079fa3cf06b411d20b8169d39de85a3d99e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309830788eda4-72f5-4e78-aa85-98477615b6ac.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309830788eda4-72f5-4e78-aa85-98477615b6ac.tmp
                                                            • Size 2KB
                                                            • SHA256 de60b1c80452374319ce72ac694375c23c9eb0d297c54cb573340934dd79b1bc
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309831d29a670-bc40-42af-be49-11509d64fdee.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309831d29a670-bc40-42af-be49-11509d64fdee.tmp
                                                            • Size 2KB
                                                            • SHA256 bf40728bd45c9771297c1e9db86babe01b8039bb98c03d6f13ba8ec2f6f41e43
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309835aae7bc1-5017-4ca8-9222-7dfad761ae01.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309835aae7bc1-5017-4ca8-9222-7dfad761ae01.tmp
                                                            • Size 561B
                                                            • SHA256 1f7e95dcbcbec5795a8beea3561c1501830ac87ef968548fcc870e2273dfad4a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309835d837be5-3356-4199-a3e2-d3b6b24d4edc.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309835d837be5-3356-4199-a3e2-d3b6b24d4edc.tmp
                                                            • Size 2KB
                                                            • SHA256 7f95f8a1766fe9c3435fc4a7e8a42e6899748e1ff91c360eeed8abf09116e07b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309835f44275f-5525-413c-afee-a087f853b2f8.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309835f44275f-5525-413c-afee-a087f853b2f8.tmp
                                                            • Size 2KB
                                                            • SHA256 0012d83bf93527e9c698db56d5bb445ef6873d6bb14b83c367e5ba762b7cfcd4
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309837a7e991d-fa5d-4108-830d-af3e0d49583c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309837a7e991d-fa5d-4108-830d-af3e0d49583c.tmp
                                                            • Size 2KB
                                                            • SHA256 1f09f94819d75eac9bca41f1e4594912c65527fe727f13273fddf701a9849b8a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309838f8cb24a-5292-4c96-b1dc-dd38edf9046c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309838f8cb24a-5292-4c96-b1dc-dd38edf9046c.tmp
                                                            • Size 2KB
                                                            • SHA256 f8a691faa6b762f01dd0819a67ac93c655828e676b3e4a23b0701a8a2ce6c31e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.7470309839109c7c9-bca5-4f38-ba02-0167d0eef208.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.7470309839109c7c9-bca5-4f38-ba02-0167d0eef208.tmp
                                                            • Size 2KB
                                                            • SHA256 86e2cebfa06ec2dfaba70afd4f891b3f15e00bb4b8468163bc5a29efe52cc0c5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.747030983c8d59d85-d481-4a05-869b-4ecf4f1a78a0.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.747030983c8d59d85-d481-4a05-869b-4ecf4f1a78a0.tmp
                                                            • Size 2KB
                                                            • SHA256 e179c41f3d88792785624cb6018fa8fb262121842c2be251d49d58c6469865e9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.747030983c954fd3e-bf3b-4d80-b978-b95d84e252b6.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.747030983c954fd3e-bf3b-4d80-b978-b95d84e252b6.tmp
                                                            • Size 1KB
                                                            • SHA256 1e782c76c3fec63bf58cc095cc426143bf4e9ab59b8df93ac1021ec199a3430c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.0.747030983d4fe5e0d-5336-4926-b050-afa1fd07e93c.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.0.747030983d4fe5e0d-5336-4926-b050-afa1fd07e93c.tmp
                                                            • Size 499B
                                                            • SHA256 05473c18b9efad648ed8542596ac1239646ea4d6d890f345d02ac262c070559d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288
                                                            • Size 171B
                                                            • SHA256 2260d1f77464be525dd05f5c86406db688d01de5301e3e76a27cad5f27c9797a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.111085928805eb4ab9-62a1-4652-a792-ec6eaee29db2.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.111085928805eb4ab9-62a1-4652-a792-ec6eaee29db2.tmp
                                                            • Size 1KB
                                                            • SHA256 73819d73742be207e14dd59eaa9fb5197389357be63021f38ccd40c15c1f28b5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288117c4c39-e62d-4d9c-a2b7-b950ac757c64.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288117c4c39-e62d-4d9c-a2b7-b950ac757c64.tmp
                                                            • Size 297B
                                                            • SHA256 6851fbfb32edce642707ce0afce1d7bd523d86ad600ffb8eb111771e47cb1ddc
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.111085928828367dd2-c3ab-4a57-af1a-75ce9c7d83e7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.111085928828367dd2-c3ab-4a57-af1a-75ce9c7d83e7.tmp
                                                            • Size 1KB
                                                            • SHA256 d2ba4646eb759649cf489f2fcc351170bc1e1edd0a21dd311f763eecb2ca61c1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592882b4f2419-5d6f-4453-b891-5feda7e98865.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592882b4f2419-5d6f-4453-b891-5feda7e98865.tmp
                                                            • Size 764B
                                                            • SHA256 7fc2341bcbded54da85028febadc20c10769991a532eb27c15d9399f9ad0f1ab
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592882c3ed06b-2409-4ded-a8b8-127af84f6fd7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592882c3ed06b-2409-4ded-a8b8-127af84f6fd7.tmp
                                                            • Size 1KB
                                                            • SHA256 657c41b5161757e557ab967488ab72a1fadd78fc998283729663188c7e4cebd2
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592883af6e7f5-e6fb-4bb5-8478-931f72c8c057.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592883af6e7f5-e6fb-4bb5-8478-931f72c8c057.tmp
                                                            • Size 1KB
                                                            • SHA256 db9eaa9b99dd075b1dc09ebdec01d744b8f993991db6e11870c1a30e33ac71e9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592883f138403-cec2-4dca-8d61-b0f47f009650.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592883f138403-cec2-4dca-8d61-b0f47f009650.tmp
                                                            • Size 485B
                                                            • SHA256 6c22207cc162474f3c662bd7abd87e0ae7b29cd05ad4e7c89d6cb72bb5c6208c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592884d6ea4b0-5964-4e69-9683-01e5e5d84025.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592884d6ea4b0-5964-4e69-9683-01e5e5d84025.tmp
                                                            • Size 1KB
                                                            • SHA256 b053a95f997001184383ffaf95339911a077b69cc420661ba2c5a9361224b85a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592885017ddb7-e4ec-4668-8f4b-9bcecab27c87.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592885017ddb7-e4ec-4668-8f4b-9bcecab27c87.tmp
                                                            • Size 1KB
                                                            • SHA256 6bbeb413e298cdfdf4a7ce4cc3783e712d486dd2e37ca8b82a2bff44a1a254f4
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.111085928879abe7c4-810a-4906-9338-129a283900ba.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.111085928879abe7c4-810a-4906-9338-129a283900ba.tmp
                                                            • Size 1KB
                                                            • SHA256 abaf9ec6a06c0ff39c4f8e1652158f1d0a59bed6eb2a318f52fe2d739e7165c5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.111085928879b1a3b5-e9e4-4c6b-8c66-8d0809df61e7.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.111085928879b1a3b5-e9e4-4c6b-8c66-8d0809df61e7.tmp
                                                            • Size 1KB
                                                            • SHA256 5a04b3a9bcabccc2792b2b4e820d41f187e2690b06e29129502cc7dacfef8ad1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.111085928883e48014-2b6e-427d-91e9-d2f4d3f849e5.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.111085928883e48014-2b6e-427d-91e9-d2f4d3f849e5.tmp
                                                            • Size 395B
                                                            • SHA256 12275ecd239070cb3823f55e669a482679999e4a30bbcf0d561325611e7825c4
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592888814978a-9137-4836-8d84-3e0eb4f2b5db.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592888814978a-9137-4836-8d84-3e0eb4f2b5db.tmp
                                                            • Size 863B
                                                            • SHA256 0ff53b402fb3bf4270d2040a08f3ea4d99b8b7e5e59c14ff805ebdc303e8f7b0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.11108592889843c2ee-255a-4e82-bf03-63a1af507883.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.11108592889843c2ee-255a-4e82-bf03-63a1af507883.tmp
                                                            • Size 1KB
                                                            • SHA256 e3e038d9218b2c4bf7d9d89ef4f7e2e409229d19913e61a7711d44a01a18322c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288a1bc84b2-df0a-4a99-86df-44cc6d7fa014.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288a1bc84b2-df0a-4a99-86df-44cc6d7fa014.tmp
                                                            • Size 1KB
                                                            • SHA256 642ae41197dda6ee591a03076ba780bec910824dcaeb08ad4c97d6bcbc6848dc
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288a6e202f9-f17d-44ef-9375-34bb433a9408.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288a6e202f9-f17d-44ef-9375-34bb433a9408.tmp
                                                            • Size 1KB
                                                            • SHA256 1a343c88b65e5474022efa3d9fe64f6bb6a64d8d7b5a56e66a24b0611d48a6f0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288a95ac024-215d-4f59-a973-08aed5822c48.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288a95ac024-215d-4f59-a973-08aed5822c48.tmp
                                                            • Size 1KB
                                                            • SHA256 01ce5238510a8be29c9f9d3aa6acedff85613be469f8f91fd2225a5015c38693
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288bd96fddf-3f40-4c24-8d86-7ab0d8736abe.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288bd96fddf-3f40-4c24-8d86-7ab0d8736abe.tmp
                                                            • Size 572B
                                                            • SHA256 f24b828f9ede516753864bee587a08ff84e495854fb53cdc7fb770c39e955300
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288cfa2c018-15c6-4f01-a1f5-aebd6540bdf6.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288cfa2c018-15c6-4f01-a1f5-aebd6540bdf6.tmp
                                                            • Size 1KB
                                                            • SHA256 ab6c7b9307ebd94051a7b2427e302e2af4e99f01ba9c65fa360139aa156afe0e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288d0fcd59a-087c-4e20-9c32-32cffcd8c7c2.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288d0fcd59a-087c-4e20-9c32-32cffcd8c7c2.tmp
                                                            • Size 1KB
                                                            • SHA256 b9f3ede3cc0a8cb0ed1290d1a4efbac3d6f5f138bd55320f3d33838fbd5b10d6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288d96b39df-f9fa-4bd9-a5ff-2c6771ece88a.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288d96b39df-f9fa-4bd9-a5ff-2c6771ece88a.tmp
                                                            • Size 955B
                                                            • SHA256 a21f819208c5e4ef650cbb78139959370988e691fdb8c5e42943e35105ea5a7f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288ebb1e5d1-dbaf-4939-a603-b3a5bd139046.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288ebb1e5d1-dbaf-4939-a603-b3a5bd139046.tmp
                                                            • Size 1KB
                                                            • SHA256 94169d313c66b15daf88a4e4a71cb9181694c023ad1b9b66745828a0b559f13f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288f5fc48d2-f9b4-4303-a839-413f3c0b74ac.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288f5fc48d2-f9b4-4303-a839-413f3c0b74ac.tmp
                                                            • Size 668B
                                                            • SHA256 d94fdc4c835f0dc86a13427c4373df02c28fbe27ffadc5b63de8a52773a5b32c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ssdfp6892.1.1110859288fb3323da-ed55-4452-bc5c-b04475e5fd92.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp6892.1.1110859288fb3323da-ed55-4452-bc5c-b04475e5fd92.tmp
                                                            • Size 1KB
                                                            • SHA256 859f8c7f52780f6daa0aadf5423d05fc71d4cf533072b26cfecf424e044635b0
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            suggestions_cache.json2ee62151-1207-4706-a117-e2c7ec69bba1.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\suggestions_cache.json2ee62151-1207-4706-a117-e2c7ec69bba1.tmp
                                                            • Size 652KB
                                                            • SHA256 dbd1bfed375a6c7a11916bd70aa707c42ef378e989baddf5cf934b5beb85f16d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State
                                                            • Size 5KB
                                                            • SHA256 e2a467eeb14fa17a75262276d30c7271984f9c6efcb81174a3cb50267e276b6f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State001bd185-b28c-4bd0-9485-220b3151f2c8.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State001bd185-b28c-4bd0-9485-220b3151f2c8.tmp
                                                            • Size 3KB
                                                            • SHA256 39a70015d65e727ef0350b4b3de5c7f0fc9b434752f91d7c800869a0a31bcc6a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Local State6c951301-e4ed-4095-944c-02f2d095ad10.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State6c951301-e4ed-4095-944c-02f2d095ad10.tmp
                                                            • Size 3KB
                                                            • SHA256 d16c189d5ad7f4c684655d9ad16b2c2f16739ccb5107119957ba34a89b918ac3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Local State83838911-428d-4c3c-adfb-29f2f4417a97.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Local State83838911-428d-4c3c-adfb-29f2f4417a97.tmp
                                                            • Size 4KB
                                                            • SHA256 77b0f1ee52586ddedd79e23a5041eb65ff2122d19d9633ab3d2b2c2d9ec31023
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            VariationsSeedV26248f947-f178-4eb6-8ffb-f06fcd7f9a79.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSeedV26248f947-f178-4eb6-8ffb-f06fcd7f9a79.tmp
                                                            • Size 19B
                                                            • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            VariationsSeedV2a0b5fdc7-c0d8-46e2-bd1e-7bdba6a61aa9.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\VariationsSeedV2a0b5fdc7-c0d8-46e2-bd1e-7bdba6a61aa9.tmp
                                                            • Size 11B
                                                            • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            clipboard_injection_guard_rules.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\clipboard_injection_guard_rules.json
                                                            • Size 7KB
                                                            • SHA256 cadfc443f92476613d67eaf9ed1b81dbb2919820e03e1c8be4e28722a24ec67a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\component_crx_cache\3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657
                                                            • Size 178KB
                                                            • SHA256 3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            metadata.json97441a0d-1250-4448-911c-38c919bf8b89.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\component_crx_cache\metadata.json97441a0d-1250-4448-911c-38c919bf8b89.tmp
                                                            • Size 236B
                                                            • SHA256 475429493eb0082fb10526b9d35f6c9e40d537b341246a89804020fccee3c8b3
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            metadata.jsona81879c6-fcf7-436c-8bcf-85188ba12273.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\component_crx_cache\metadata.jsona81879c6-fcf7-436c-8bcf-85188ba12273.tmp
                                                            • Size 124B
                                                            • SHA256 b26d57b79d4e635181f5c9aab4811e09a80546a6a7ff6f102b7a4a6b07a19326
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            metadata.jsonb5d4bd78-3865-4a35-876b-067c4e78769d.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\extensions_crx_cache\metadata.jsonb5d4bd78-3865-4a35-876b-067c4e78769d.tmp
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6892_1279000569\manifest.json
                                                            • Size 72B
                                                            • SHA256 a408d874f731da9fd242aca690324d2fa05a2b80ee0744e49543dd514a1cb07f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6892_1898365776\manifest.json
                                                            • Size 73B
                                                            • SHA256 665f841d266f0d6eedf1e635138cd954542dc028a9e8c47e0b29f90cd772d3e8
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            persona.ini
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_1309823408\persona.ini
                                                            • Size 203B
                                                            • SHA256 8ab3f6191e24c4ba127f127a377ddd1b822ee2a23c71cda7ef200ffea21cd032
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            wave-light.jpg
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_1309823408\wave-light.jpg
                                                            • Size 186KB
                                                            • SHA256 27cd55b501cff3492e374b7101b8b674f03c63264ba2c3c2c1aef22b6793714c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            opera-one.jpg
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_1661168427\opera-one.jpg
                                                            • Size 194KB
                                                            • SHA256 2e8375c8ba1c0f5379de54bf4bcb0af7ae0ef3c2a6af07409c8d007ff0685b71
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            persona.ini
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_1661168427\persona.ini
                                                            • Size 207B
                                                            • SHA256 7cd803353a8af5af891ddf63908e408d1667cfc4b4d2882c61a0fe734df919ec
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            opera-one-dark.jpg
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_57950116\opera-one-dark.jpg
                                                            • Size 349KB
                                                            • SHA256 70b35d024405f6adfb37715e58cadeefab36e305158a73e8a4cc377bae1a4476
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            persona.ini
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_57950116\persona.ini
                                                            • Size 217B
                                                            • SHA256 69feb09a5aa11d2badb4cdf17c2ddf7861a97a1d3a6add0ded22e5e9e07defc5
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            persona.ini
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_779201103\persona.ini
                                                            • Size 202B
                                                            • SHA256 296b47c9dc0911b45cd8ae99e11cedd122f19baba58eb9e04abbd82bee04df2b
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            wave-dark.jpg
                                                            • Path C:\Windows\SystemTemp\scoped_dir6892_779201103\wave-dark.jpg
                                                            • Size 117KB
                                                            • SHA256 e7e1ac6562391b443e486f5da83f999bf0caa1e4da7e10748054f011d0006e34
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            memory/2172-578-0x00007FFB58B30000-0x00007FFB58B31000-memory.dmp
                                                            Download

                                                            memory/2172-577-0x00007FFB579D0000-0x00007FFB579D1000-memory.dmp
                                                            Download

                                                            memory/5076-3970-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download

                                                            memory/5076-3969-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download

                                                            memory/5076-3968-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download

                                                            memory/5076-3967-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download

                                                            memory/5076-3966-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download

                                                            memory/5076-3965-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download

                                                            memory/5076-3961-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download

                                                            memory/5076-3959-0x000001F6A6D80000-0x000001F6A6D81000-memory.dmp
                                                            Download