Analysis
- user interaction
yes - max time kernel
537s - max time network
551s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
24/04/2026, 01:05
General
- Target https://cdn.discordapp.com/attachments/1496987897310482582/1496990074997575845/Madium.rar?ex=69ebe426&is=69ea92a6&hm=e5779cc9f7f72c34c499ded74ac47c8cfd2d3cb30a1b8ca0c30cbfcc84e9b6a1&
- Sample260424-bfqd5aaz2k
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Checks computer location settings 2 TTPs 19 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Probable phishing domain 1 TTPs 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 64 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1496987897310482582/1496990074997575845/Madium.rar?ex=69ebe426&is=69ea92a6&hm=e5779cc9f7f72c34c499ded74ac47c8cfd2d3cb30a1b8ca0c30cbfcc84e9b6a1&1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffec477c188,0x7ffec477c194,0x7ffec477c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,1611777998600000351,1516184682304932544,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,7833881539985237244,2385263102076923117,262144 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,12266250391259214889,3089683270751334395,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,4447163311023263549,11034516478838615946,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15464421855282880660,12834445263345253836,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,17594526366499032019,5854699825625473999,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9473053527932596460,629981941052853772,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5500,i,7282535085508519641,2311761680730493852,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,14260550162087009511,9279742654391199722,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,448657553951016488,2854570299936640833,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14831892118633456860,16574485361233749137,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14831892118633456860,16574485361233749137,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3724,i,15883592912064309389,14698134915104496960,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5740,i,1991641087408741695,17530000166238562293,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,7132183390173423105,14048866554122944767,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,6368633603311928981,15027346441541756735,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,7364911939576602086,2454228763585206163,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,8408334625578806041,356985442856591802,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,702261563216581567,4300933850044596489,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,7172082695768783213,3080919244237898277,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,7172082695768783213,3080919244237898277,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7124,i,9454741680258313460,13443408102838081615,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5220,i,5114879473685954934,2509702377915486104,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,6493644786814155251,11636558104022585996,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6896,i,15353407769588774871,1362118431445967887,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,12288118954246085965,3480025838881132022,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,5681718041627527367,2782104247359622576,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2114313526086505263,13055104734112973779,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,824847635846920245,11988145453585366880,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5132,i,14478876744179369488,9175692495264052836,262144 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5460,i,1842014231487628267,12559850458115555153,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4980,i,8270673483722898340,4897535455250518074,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,12133373339204263347,6114048799379658181,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,11012561636245178401,14994174325351756492,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,407076784347978485,13627419898893049897,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,15813457830125782658,18438505226816849287,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=1324 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,17635444249400784869,9361552260076869083,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6516,i,11780387594229873181,1751198772379782036,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5612,i,11047591440059223912,3474670300110186875,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6488,i,2705311109560133096,12184803682190144467,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=4980,i,16640385649317128778,7588991092776313515,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7768,i,12692849590082832743,10283769671596932913,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5148,i,516743388700741416,2218817118657131035,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7428,i,15207786236189854944,5429195683067657607,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7872,i,5497899767692877069,18023527903874592417,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6832,i,13115050683543225660,8107656905883596863,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8084,i,7916571782385260365,7978538113074016417,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7120,i,4752253041808009174,7759020132980830130,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7720,i,7317035404341009059,12924201658469059193,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7992,i,1241659351882383041,323706464513683764,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=5184,i,12660027803916645466,3226787539906482821,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7640,i,14528531587067636757,17491521794142554305,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7820,i,11427479664967190472,12260783043194173420,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13259001483683441232,11998704829413253027,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7976,i,12009601020596869995,5431069509883498000,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8052,i,5610835645540417042,2910594879641563397,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=5056,i,7944253158057618438,2966927412785515600,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7996,i,15671375646829968022,433514506795600971,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7776,i,7718003405990234755,11661240811344229108,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7788,i,610672885758975663,1367746442190930073,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7612,i,4964202875312974212,2494255539771865704,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,4478853732529886427,5247168128939377125,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8244,i,16024765675520230431,13530583667671760240,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=5984,i,11382158980842660609,7374028962386422420,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7100,i,13143998507035414622,17902690975153760886,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8428,i,8015283309857348008,15312007490441605445,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=7988,i,15052405648052320563,3605838848936850620,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=7824,i,4446271518154187156,14113753136317158482,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8216,i,12912971875140565901,8162178108579806453,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,4273407501356681383,6016761887472362060,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,4273407501356681383,6016761887472362060,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,172902049548043102,10193488160848774006,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,172902049548043102,10193488160848774006,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=5284,i,13950078897604828673,13898467873382416426,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8309378673776741735,573171970735148422,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=5768,i,8919231227094393923,7657508573839244212,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=7592,i,13485927089258900580,17442312783525338125,2097152 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8608,i,2760714899928017777,3272736754107246078,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7720,i,4065073881420445698,16242195058726266605,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8920,i,10673074278086754878,11958658289214349710,524288 --field-trial-handle=2272,i,14819191599078676666,6571753385182864232,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap27290:74:7zEvent287641⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19576:82:7zEvent134821⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\OperaSetup.exe"C:\Users\Admin\Downloads\OperaSetup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exe --server-tracking-blob=NjZiMjg1OTMxMWNhZjg4ZGMxMzkxYzBiZGI3OTFlMGM2Mjg2NDVkODNkOTY1NzA5N2E0YzYxOWNhYTllZWM4ZTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWVtZXJlcm8mdXRtX21lZGl1bT1wZCZ1dG1fY2FtcGFpZ249bWImdXRtX2NvbnRlbnQ9MTIyOTUzNyZ1dG1faWQ9RU1jMDEyYmY3MjY5ZTVhMTA3NDVkMjg5MTNhYzJiYjkxNDY1NTEiLCJ0aW1lc3RhbXAiOiIxNzc2OTkzMDM4LjI4MzIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6Im1iIiwiY29udGVudCI6IjEyMjk1MzciLCJpZCI6IkVNYzAxMmJmNzI2OWU1YTEwNzQ1ZDI4OTEzYWMyYmI5MTQ2NTUxIiwibWVkaXVtIjoicGQiLCJzb3VyY2UiOiJlbWVyZXJvIn0sInV1aWQiOiIwNDkwMWJhYy00NDg3LTQyYmYtYWQ0MS02MzlhM2M0MWUyZmUifQ==2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff6253636d8,0x7ff6253636e4,0x7ff6253636f03⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\installer.exe" --version3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x260,0x264,0x268,0x21c,0x26c,0x11d4040,0x11d404c,0x11d40584⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exe"C:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4116 --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571" --session-guid=72043e8c-5523-45f2-bdda-e15fc963394f --server-tracking-blob=NzVkMTIwMzRlNDBlY2U3MWJlYTRkOGU5ZGY2NTI2MmU4MDY1OGRjZjM1OTVhMWY2OTA0OTAwYTQ1N2Y0NzNiNTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWVtZXJlcm8mdXRtX21lZGl1bT1wZCZ1dG1fY2FtcGFpZ249bWImdXRtX2NvbnRlbnQ9MTIyOTUzNyZ1dG1faWQ9RU1jMDEyYmY3MjY5ZTVhMTA3NDVkMjg5MTNhYzJiYjkxNDY1NTEiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3NzY5OTMwMzguMjgzMiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzkuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTM5LjAuMC4wIiwidXRtIjp7ImNhbXBhaWduIjoibWIiLCJjb250ZW50IjoiMTIyOTUzNyIsImlkIjoiRU1jMDEyYmY3MjY5ZTVhMTA3NDVkMjg5MTNhYzJiYjkxNDY1NTEiLCJtZWRpdW0iOiJwZCIsInNvdXJjZSI6ImVtZXJlcm8ifSwidXVpZCI6IjA0OTAxYmFjLTQ0ODctNDJiZi1hZDQxLTYzOWEzYzQxZTJmZSJ9 --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC0A0000000000003⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS88A2127F\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x2a8,0x2ac,0x2b0,0x278,0x2b8,0x7ff6253636d8,0x7ff6253636e4,0x7ff6253636f04⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exe" --backend --initial-pid=4116 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571" --session-guid=72043e8c-5523-45f2-bdda-e15fc963394f --server-tracking-blob=NzVkMTIwMzRlNDBlY2U3MWJlYTRkOGU5ZGY2NTI2MmU4MDY1OGRjZjM1OTVhMWY2OTA0OTAwYTQ1N2Y0NzNiNTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWVtZXJlcm8mdXRtX21lZGl1bT1wZCZ1dG1fY2FtcGFpZ249bWImdXRtX2NvbnRlbnQ9MTIyOTUzNyZ1dG1faWQ9RU1jMDEyYmY3MjY5ZTVhMTA3NDVkMjg5MTNhYzJiYjkxNDY1NTEiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3NzY5OTMwMzguMjgzMiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzkuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTM5LjAuMC4wIiwidXRtIjp7ImNhbXBhaWduIjoibWIiLCJjb250ZW50IjoiMTIyOTUzNyIsImlkIjoiRU1jMDEyYmY3MjY5ZTVhMTA3NDVkMjg5MTNhYzJiYjkxNDY1NTEiLCJtZWRpdW0iOiJwZCIsInNvdXJjZSI6ImVtZXJlcm8ifSwidXVpZCI6IjA0OTAxYmFjLTQ0ODctNDJiZi1hZDQxLTYzOWEzYzQxZTJmZSJ9 --desktopshortcut=1 --install-subfolder=130.0.5847.824⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff6706936d8,0x7ff6706936e4,0x7ff6706936f05⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=05⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x11d4040,0x11d404c,0x11d40586⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=06⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x1034040,0x103404c,0x10340587⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream8⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc109⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream8⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x80,0x88,0x8c,0x84,0x90,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc109⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x284,0x288,0x28c,0x23c,0x290,0xe6c830,0xe6c83c,0xe6c8488⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc1010⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc1010⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x264,0x268,0x26c,0x25c,0x270,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc1010⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\47358385-6671-4c14-a83f-2b9893f48c2e Opera Installer Temp\opera_package_202604240213571\de932af914ba00303d4a2778a383ac9c831101e2.crx"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc106⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,7274883914076792069,7779645616949950164,262144 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2144,i,6375524092616904668,3511086422616372697,524288 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2164 /prefetch:36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- System Time Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2356,i,17524749128841816620,5039723059962358761,524288 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2228 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=2988,i,13753478471521024448,13949638842721618738,2097152 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3020 /prefetch:26⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3008,i,11592007645418159855,11032382988240526203,2097152 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3048 /prefetch:26⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4388,i,4541623766709653668,785939549027305694,524288 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4420 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4692,i,15355570511705209263,6128900009129926293,524288 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4684 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4808,i,1666356735921763818,16728700076774105355,2097152 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4872 /prefetch:26⤵
- Checks computer location settings
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5008,i,11466179801616777021,17041258042299544151,524288 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5020 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5152,i,7766147895629769887,6928781883215187901,524288 --field-trial-handle=1900,i,10126064480433318567,18260324140980526387,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1904,i,8795631531117093561,6107008997665261140,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5164 /prefetch:86⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x26c,0x270,0x274,0x268,0x278,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc106⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1812,i,9257415915204953545,6959418070466605868,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2212 /prefetch:36⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- System Time Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,4205623870241265859,2939279582569031336,262144 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2176 /prefetch:26⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2416,i,15451182656307700942,293786080499773213,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2408 /prefetch:86⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2928,i,14054075084147093602,7820327233080780219,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3032 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2940,i,15071490004410782376,680792033966688192,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3052 /prefetch:86⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2916,i,2584075592129794226,5103283760425790571,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3012 /prefetch:86⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2964,i,2265925107076656576,4536893794192312873,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3084 /prefetch:86⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2952,i,8546480704773069708,4407334750826016542,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=2996 /prefetch:86⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2976,i,18305867320364137361,14629406245763767288,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3104 /prefetch:86⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3380,i,14156698417978953554,17576978469886752481,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3376 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2988,i,1690877902754989258,11227262124698357559,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3124 /prefetch:86⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_gx_splash.exe"C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C966⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4624,i,14472962329459693124,5063439063343450073,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4652 /prefetch:26⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4788,i,7923269046002007203,17089240327293076611,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4816 /prefetch:16⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5112,i,17090279629947786149,4873635896248949178,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5128 /prefetch:16⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5248,i,5901557871642650076,5013230961021025437,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5272 /prefetch:16⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6336,i,14630669743954193640,5419215906266830935,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6368 /prefetch:26⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6792,i,8074172239210180037,6499044179350582053,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6844 /prefetch:26⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6680,i,5309714941634634073,5815497051999959825,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6940 /prefetch:26⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7236,i,3767327910919065793,11825920050122812474,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6300 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6348,i,9969430574225564651,15626006188621853084,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7176 /prefetch:86⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7120,i,18039083385954990345,6059181977892759087,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7428 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7564,i,969696510791009846,12080345876711142226,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7636 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7556,i,7094865594276783988,7298879698865413464,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7616 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6280,i,7866267629496318531,14177069949141750893,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7576 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7540,i,3885495995015013820,145189881447958586,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7596 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8164,i,13705136212112163484,5984828819976021290,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8176 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8240,i,14670484168926463910,17830267952398329620,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8296 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8144,i,13824341392553253621,16854835648102051826,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8232 /prefetch:86⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8212,i,15848403734479293832,9727650462538818127,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8264 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8300,i,1201069096133855869,10042897159787163793,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8348 /prefetch:86⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8156,i,12830920923046509313,13849185639303959604,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8148 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8284,i,6960896323863984503,12536313172685701235,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8320 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=9044,i,14541683963607141182,10258656023382592963,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9192 /prefetch:26⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9356,i,15452503836695867034,2473271939387447903,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9348 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9480,i,1006571386191928137,7117483548869720718,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=6328 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9588,i,2475103703935496367,11117683481693952536,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9608 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9740,i,4625884130418963176,11972231412598709910,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9752 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9760,i,15972604512474971044,8454323665318961808,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9904 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9948,i,7611871976286957248,652657937487234677,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=9960 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10200,i,1888539845197491494,15642743918268084500,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10184 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10336,i,18444953889186163764,13197898923295173241,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10348 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10384,i,8613444152691959140,10698510836736252387,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10480 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=10628,i,2902134543331431246,17355260021531913295,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10644 /prefetch:16⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9200,i,11932591167746120849,15270075255447875597,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=9052 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11408,i,11602342807247813513,7050273353774413142,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=11392 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3428,i,11298371393706321008,7757539853066706626,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=3200 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11580,i,9336786034751650650,1491341945988914238,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11592 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11800,i,4351312976456766077,11016140979074696743,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=11784 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F1616⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff6e8372738,0x7ff6e8372744,0x7ff6e83727507⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exe" --fix-taskbar-pins6⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6706936d8,0x7ff6706936e4,0x7ff6706936f07⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12072,i,17869332538883091670,14618317706741030627,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=12076 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=12212,i,2570528390951640851,2549721131055326375,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=12268 /prefetch:16⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12392,i,13031347594736131817,710009901539870386,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=12404 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12192,i,4077825077157181152,7324231851941338504,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=12504 /prefetch:86⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12096,i,18380524543877068103,180463509456059286,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=12464 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12176,i,13018361947304349387,17457188284101593362,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=4088 /prefetch:86⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4112,i,7191604903373281902,17295049114525184243,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=4044 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12456,i,14751807812115815955,10181590504502779426,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=6644 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=5568,i,12259580582940358705,675574984297334289,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=12420 /prefetch:26⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7996,i,9949111717432801995,149560753871349325,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=7640 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=5520,i,8968679082218862632,14683697814292727312,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=9364 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7408,i,14933341415613074503,5897606109618512184,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=7536 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7964,i,8736147508550206175,18143584785696651544,524288 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=7928 /prefetch:86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=12108,i,17786320243970247894,3600793328442262098,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=9164 /prefetch:26⤵
- Checks computer location settings
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=6644,i,9863431813074483883,5399811380210806163,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=8824 /prefetch:26⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-intent=on --with-feature:address-bar-intent-competitors=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amp-requests-stats=on --with-feature:audio-analysis=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-tracking-rules=on --with-feature:continue-filter=on --with-feature:continue-shopping-ebay-cms-configuration=on --with-feature:discord-in-sidebar=on --with-feature:domain-suggestions-competitors=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:domain-suggestions-with-misspells=on --with-feature:early-bird=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=off --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-partners-attributions=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=3756,i,10309513588529943807,3480139982475934351,2097152 --field-trial-handle=2180,i,12940208352493943653,3243123493186715596,262144 --enable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,PermissionElement,PlatformSoftwareH264EncoderInGpu --disable-features=CapitalOneCashbackProtection,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2184,i,13978605311753453351,4281523310216836955,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=3780 /prefetch:16⤵
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc103⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc103⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x274,0x278,0x27c,0x248,0x280,0xe6c830,0xe6c83c,0xe6c8482⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc104⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc104⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream3⤵
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc104⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exeC:\Users\Admin\AppData\Local\Programs\Opera\opera.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\130.0.5847.82\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x25c,0x260,0x264,0x258,0x268,0x7ffe8db7fbf0,0x7ffe8db7fc00,0x7ffe8db7fc102⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC11⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.82 --initial-client-data=0x274,0x278,0x27c,0x20c,0x280,0x7ff6e8372738,0x7ff6e8372744,0x7ff6e83727502⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
648e5fdc-b5ef-4e76-8472-31a12dfadf35.tmp
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000084
f_000085
f_00008a
f_00008b
f_00008c
f_00008d
f_00008e
f_000096
f_000098
f_000099
f_00009a
f_00009b
f_00009c
f_00009f
f_0000a1
f_0000a7
f_0000b6
f_0000b7
f_0000b9
f_0000cc
f_0000d2
f_0000d5
f_0000dc
f_0000e5
f_0000ea
f_0000eb
f_0000ef
f_0000f0
f_00010a
f_00010d
f_00011c
f_000152
f_000154
2368cc2f68a9533b_0
30d592deb734362a_0
3609e049509c0061_0
38c5bea296ec9004_0
83d9aa7b71e2b169_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe588066.TMP
SiteList-Enterprise.json
HubApps
000003.log
CURRENT
LOG
LOG
LOG
LOG
MANIFEST-000001
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5f71ed.TMP
index.txt
index.txt
index.txt~RFe5f725a.TMP
040325f9f646be58_0
040325f9f646be58_1
1a9cc9dd3fef15e7_0
1a9cc9dd3fef15e7_1
1f2b2ec918288a7e_0
1f2b2ec918288a7e_1
1fc437d7e4bebf21_0
1fc437d7e4bebf21_1
22ff7460c662cc2b_0
22ff7460c662cc2b_1
2f53d748c631762c_0
2f53d748c631762c_1
2f80e4753a5de945_0
2f80e4753a5de945_1
40f0b162b06fe2d1_0
40f0b162b06fe2d1_1
43d0c42346261371_0
43d0c42346261371_1
4d2707a2bd8aa9ef_0
4d2707a2bd8aa9ef_1
588da9daa177b1f7_0
588da9daa177b1f7_1
64458e8e93817f43_0
64458e8e93817f43_1
6abf69e2891709f1_0
6abf69e2891709f1_1
6ad29b89a7e96d6f_0
6ad29b89a7e96d6f_1
81fd71721170aae6_0
81fd71721170aae6_1
83f962d59df5d2c9_0
83f962d59df5d2c9_1
8ff5f32ff5979d44_0
8ff5f32ff5979d44_1
9979dfa59baae60c_0
9979dfa59baae60c_1
aa788de8f8818aff_0
aa788de8f8818aff_1
af7eeb91b855aeb3_0
af7eeb91b855aeb3_1
b6f1dc444109a9c0_0
b6f1dc444109a9c0_1
b8b370eb087dd18b_0
b8b370eb087dd18b_1
baeda5df7ac553a6_0
baeda5df7ac553a6_1
c7bdfefd3de461dc_0
c7bdfefd3de461dc_1
d045e17bfbb95051_0
d045e17bfbb95051_1
d53ff6cfc7a32f53_0
d53ff6cfc7a32f53_1
e1d82b4b93bd6f7e_0
e1d82b4b93bd6f7e_1
e791698e452c6763_0
e791698e452c6763_1
fa994cbfdf595d28_0
fa994cbfdf595d28_1
fec2bedb486a72e5_0
fec2bedb486a72e5_1
the-real-index
the-real-index~RFe588a69.TMP
623cd082b6202da0_0
623cd082b6202da0_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5867dd.TMP
4f2277ea2139c475_0
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
9189894501eb1e71_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe587589.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
297ecea5cebb5dfe_0
297ecea5cebb5dfe_1
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index~RFe588613.TMP
sync_diagnostic.log
MANIFEST-000001
domain_actions.dll
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5b631b.TMP
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
f_000001
installer_prefs.json
Opera Browser.lnk
Assistant_130.0.5847.41_Setup.exe_sfx.exe
installer_prefs_include.json
installer_prefs_include.json
installer_prefs_include.json
installer.exe
8331578a-f577-4f3d-9faf-3f89a2ae8d47.tmp
favicon_opera_one.png
webpage_content_reporter.js
Noteworthy-Light.ttf
SpaceMono-Regular.ttf
envelope-back.svg
envelope-front.svg
letter.svg
popup-background-darkmode.svg
popup-background.svg
1995.png
1996.png
1997.png
1998.png
1999.png
2000.png
2001.png
2002.png
2003.png
2004.png
2005.png
2006.png
2007.png
2008.png
2009.png
2010.png
2011.png
2012.png
2013.png
2014.png
2015.png
2016.png
2017.png
2018.png
2019.png
2020.png
2021.png
2022.png
2023.png
2024.png
2025.png
memory.png
index.js.LICENSE.txt
manifest.json
manifest.json
Icon_Light_Neutral.png
default.dic
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
settings.dat
Bookmarks
BookmarksExtras
the-real-index
the-real-index
index
background.js
index.js
cos-bridge.js
cos-content.js
main.js
background.js
Icon_Light_Neutral.png
popup.js.LICENSE.txt
rules.json
028f682f-c0dd-4a28-b97d-3f068cb85536.tmp
1241c2bf-c1cf-4ce4-899d-a58624b12f4d.tmp
2f58614e-257e-49a0-b29c-8a39276b14a1.tmp
34d23471-011a-4dc2-a482-f8d04f122797.tmp
3aec96df-586b-4910-ae59-25f16e82dd6e.tmp
e0e7612b-075c-4718-aa9a-39a0f5770af4.tmp
Network Persistent State
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe5fd097.TMP
index
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw
session_405e733c-867b-457f-aab1-6ba112d5084e.raw~RFe5fed95.TMP
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw
session_8691fd63-f96c-4ce7-8f3e-09cd1a5be1f0.raw~RFe5fcb48.TMP
a6747d5c-b8ad-4638-8fbc-7c968c3082a9.tmp
dd344b11-cd34-4664-9734-bdbefa53a1b7.tmp
ssdfp5240.0.799576101
ssdfp5240.0.799576101
ssdfp5240.0.799576101
ssdfp5240.0.799576101~RFe5fd097.TMP
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726
ssdfp8132.0.1093015726~RFe5ff621.TMP
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470
ssdfp8132.1.323984470~RFe5ff96c.TMP
data_0
data_1
data_2
data_3
Local State
OperaSetup (1).exe.crdownload
OperaSetup (2).exe.crdownload
OperaSetup.exe.crdownload
edge_checkout_page_validator.js
miniwallet.bundle.js.LICENSE.txt
notification.bundle.js.LICENSE.txt
strings.json
memory/720-4706-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4720-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4708-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4707-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4723-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4724-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4725-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4726-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4722-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/720-4721-0x000001B660FC0000-0x000001B660FC1000-memory.dmp
memory/732-5063-0x0000000001060000-0x00000000010BF000-memory.dmp
memory/1324-4700-0x0000000000EA0000-0x0000000000EFF000-memory.dmp
memory/2300-6807-0x0000000001160000-0x00000000011BF000-memory.dmp
memory/2760-6808-0x00000000013D0000-0x000000000142F000-memory.dmp
memory/4116-6623-0x000001ECF2430000-0x000001ECF243C000-memory.dmp
memory/4116-4043-0x000001ECF2430000-0x000001ECF243C000-memory.dmp
memory/4328-6806-0x00000000014B0000-0x000000000150F000-memory.dmp
memory/4792-4825-0x0000000000CC0000-0x0000000000D1F000-memory.dmp
memory/4904-6509-0x0000000001300000-0x000000000135F000-memory.dmp
memory/4948-5090-0x00007FFED4620000-0x00007FFED4621000-memory.dmp
memory/4948-5091-0x00007FFED3B00000-0x00007FFED3B01000-memory.dmp
memory/5340-5065-0x00000000008A0000-0x00000000008FF000-memory.dmp
memory/5476-6586-0x000001B835A10000-0x000001B835A1C000-memory.dmp
memory/6112-6577-0x0000000000840000-0x000000000089F000-memory.dmp
memory/6112-6579-0x0000000003C90000-0x0000000003CA0000-memory.dmp
memory/6112-6580-0x0000000003CA0000-0x0000000003CC8000-memory.dmp
memory/6112-6578-0x0000000003C10000-0x0000000003C8D000-memory.dmp
memory/7068-6946-0x0000000000610000-0x000000000066F000-memory.dmp