a092da5c6df6c6be4341846f43425006ee0da2ce96953cf98a4b947457824ac4

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

pid	Process
6624	GameBarPresenceWriter.exe
4084	GameBarPresenceWriter.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c8d4-2523.dat	upx
behavioral2/memory/7120-2526-0x0000000000C20000-0x0000000001220000-memory.dmp	upx
behavioral2/memory/7120-3129-0x0000000000C20000-0x0000000001220000-memory.dmp	upx
behavioral2/files/0x000a00000001cafd-3152.dat	upx
behavioral2/memory/2108-3159-0x00000000009E0000-0x0000000000FD7000-memory.dmp	upx
behavioral2/memory/7120-3210-0x0000000000C20000-0x0000000001220000-memory.dmp	upx
behavioral2/memory/2108-3211-0x00000000009E0000-0x0000000000FD7000-memory.dmp	upx
behavioral2/memory/7120-3213-0x0000000000C20000-0x0000000001220000-memory.dmp	upx
behavioral2/memory/7120-3232-0x0000000000C20000-0x0000000001220000-memory.dmp	upx
behavioral2/memory/7120-3855-0x0000000000C20000-0x0000000001220000-memory.dmp	upx
behavioral2/memory/7120-3880-0x0000000000C20000-0x0000000001220000-memory.dmp	upx
behavioral2/memory/2108-3891-0x00000000009E0000-0x0000000000FD7000-memory.dmp	upx
behavioral2/memory/2108-4322-0x00000000009E0000-0x0000000000FD7000-memory.dmp	upx
behavioral2/memory/2108-4564-0x00000000009E0000-0x0000000000FD7000-memory.dmp	upx
behavioral2/memory/2108-4679-0x00000000009E0000-0x0000000000FD7000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
9208	cmd.exe
2036	cmd.exe
9796	cmd.exe
2460	cmd.exe
10060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LegacyLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tlauncher-1-9-5-5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opera-installer-bro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	browser_assistant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LegacyLauncher.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	browser_assistant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
8964	java.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
984	opera.exe
8964	java.exe
2140	chrome.exe
4260	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4568-1-0x0000000000090000-0x00000000001E1000-memory.dmp	innosetup
behavioral2/memory/4568-9-0x0000000000090000-0x00000000001E1000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 14 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opera.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera_autoupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera_autoupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera_autoupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	browser_assistant.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	browser_assistant.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	opera.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\browser_assistant.exe = "9000"	assistant_installer.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302511461500669"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.xhtml	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Opera GXStable\FriendlyTypeName = "Opera GX Web Document"	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.gxanimations\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.shtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.opdownload	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\NodeSlot = "5"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Opera GXStable\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera GX\\opera.exe\" -noautoupdate -- \"%1\""	installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.pdf\OpenWithProgIDs\Opera GXStable = "0"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.xhtml\OpenWithProgIDs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{DE2B70EC-9BF7-4A93-BD3D-243F7881D492}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Opera GXStable	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	java.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
5556	chrome.exe
5556	chrome.exe
2108	irsetup.exe
2108	irsetup.exe
6240	opera.exe
6240	opera.exe
9872	WMIC.exe
9872	WMIC.exe
9872	WMIC.exe
9872	WMIC.exe
5880	dxdiag.exe
5880	dxdiag.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4516	chrome.exe
9332	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
2644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5136	ShellHost.exe
Token: SeCreatePagefilePrivilege	5136	ShellHost.exe
Token: SeShutdownPrivilege	5136	ShellHost.exe
Token: SeCreatePagefilePrivilege	5136	ShellHost.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe
Token: SeShutdownPrivilege	2644	chrome.exe
Token: SeCreatePagefilePrivilege	2644	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5136	ShellHost.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
6984	browser_assistant.exe
6984	browser_assistant.exe
6240	opera.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
6984	browser_assistant.exe
6984	browser_assistant.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
6240	opera.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe
2644	chrome.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
5136	ShellHost.exe
4996	ShellHost.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
7120	irsetup.exe
7120	irsetup.exe
7120	irsetup.exe
7120	irsetup.exe
2108	irsetup.exe
2108	irsetup.exe
7120	irsetup.exe
2864	javaw.exe
2864	javaw.exe
1888	OpenWith.exe
4076	SecHealthUI.exe
2864	javaw.exe
2864	javaw.exe
844	OpenWith.exe
9056	javaw.exe
9056	javaw.exe
9332	chrome.exe
8964	java.exe
9332	chrome.exe
9332	chrome.exe
8964	java.exe
9332	chrome.exe
9332	chrome.exe
7200	PickerHost.Exe
9332	chrome.exe
9332	chrome.exe
5880	dxdiag.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 1696	4568	LegacyLauncher.exe	102
PID 2644 wrote to memory of 5932	2644	chrome.exe	105
PID 2644 wrote to memory of 4260	2644	chrome.exe	106
PID 2644 wrote to memory of 3176	2644	chrome.exe	107
PID 2644 wrote to memory of 3176	2644	chrome.exe	107
PID 2644 wrote to memory of 704	2644	chrome.exe	109
PID 2644 wrote to memory of 704	2644	chrome.exe	109
PID 2644 wrote to memory of 2728	2644	chrome.exe	110
PID 2644 wrote to memory of 2728	2644	chrome.exe	110
PID 2644 wrote to memory of 5560	2644	chrome.exe	111
PID 2644 wrote to memory of 5560	2644	chrome.exe	111
PID 2644 wrote to memory of 2764	2644	chrome.exe	112
PID 2644 wrote to memory of 2764	2644	chrome.exe	112
PID 2644 wrote to memory of 1600	2644	chrome.exe	113
PID 2644 wrote to memory of 1600	2644	chrome.exe	113
PID 2644 wrote to memory of 256	2644	chrome.exe	114
PID 2644 wrote to memory of 4560	2644	chrome.exe	115
PID 2644 wrote to memory of 4560	2644	chrome.exe	115
PID 2644 wrote to memory of 1740	2644	chrome.exe	116
PID 2644 wrote to memory of 1740	2644	chrome.exe	116
PID 2644 wrote to memory of 1960	2644	chrome.exe	118
PID 2644 wrote to memory of 1960	2644	chrome.exe	118
PID 2644 wrote to memory of 4476	2644	chrome.exe	119
PID 2644 wrote to memory of 4476	2644	chrome.exe	119
PID 2644 wrote to memory of 2164	2644	chrome.exe	120
PID 2644 wrote to memory of 2164	2644	chrome.exe	120
PID 2644 wrote to memory of 5800	2644	chrome.exe	121
PID 2644 wrote to memory of 5800	2644	chrome.exe	121
PID 2644 wrote to memory of 5748	2644	chrome.exe	122
PID 2644 wrote to memory of 5748	2644	chrome.exe	122
PID 2644 wrote to memory of 4444	2644	chrome.exe	123
PID 2644 wrote to memory of 4444	2644	chrome.exe	123
PID 2644 wrote to memory of 6720	2644	chrome.exe	127
PID 2644 wrote to memory of 6720	2644	chrome.exe	127
PID 2644 wrote to memory of 6768	2644	chrome.exe	128
PID 2644 wrote to memory of 6768	2644	chrome.exe	128
PID 2644 wrote to memory of 7056	2644	chrome.exe	129
PID 2644 wrote to memory of 7056	2644	chrome.exe	129
PID 2644 wrote to memory of 1072	2644	chrome.exe	130
PID 2644 wrote to memory of 5328	2644	chrome.exe	131
PID 2644 wrote to memory of 1072	2644	chrome.exe	130
PID 2644 wrote to memory of 5328	2644	chrome.exe	131
PID 2644 wrote to memory of 6588	2644	chrome.exe	132
PID 2644 wrote to memory of 1924	2644	chrome.exe	133
PID 2644 wrote to memory of 3888	2644	chrome.exe	134
PID 2644 wrote to memory of 6836	2644	chrome.exe	135
PID 2644 wrote to memory of 6836	2644	chrome.exe	135
PID 2644 wrote to memory of 3240	2644	chrome.exe	136
PID 2644 wrote to memory of 3240	2644	chrome.exe	136
PID 2644 wrote to memory of 5556	2644	chrome.exe	137
PID 2644 wrote to memory of 7028	2644	chrome.exe	138
PID 2644 wrote to memory of 7028	2644	chrome.exe	138
PID 2644 wrote to memory of 7112	2644	chrome.exe	139
PID 2644 wrote to memory of 7112	2644	chrome.exe	139
PID 2644 wrote to memory of 2640	2644	chrome.exe	140
PID 2644 wrote to memory of 2640	2644	chrome.exe	140
PID 2644 wrote to memory of 2012	2644	chrome.exe	141
PID 2644 wrote to memory of 2012	2644	chrome.exe	141
PID 2644 wrote to memory of 3820	2644	chrome.exe	142
PID 2644 wrote to memory of 3820	2644	chrome.exe	142
PID 2644 wrote to memory of 4780	2644	chrome.exe	143
PID 2644 wrote to memory of 4780	2644	chrome.exe	143
PID 2644 wrote to memory of 4516	2644	chrome.exe	144
PID 2644 wrote to memory of 1832	2644	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5136

C:\Users\Admin\AppData\Local\Temp\LegacyLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\LegacyLauncher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\is-ZD8CNZCJNQ.tmp\LegacyLauncher.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ZD8CNZCJNQ.tmp\LegacyLauncher.tmp" /SL5="$60114,115006833,1320448,C:\Users\Admin\AppData\Local\Temp\LegacyLauncher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1696

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffa5e1fc728,0x7ffa5e1fc734,0x7ffa5e1fc740
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,3126697083818247294,5667407014639296499,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,10069627756153001699,3695331085648890006,262144 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,9031292820499628722,9969757043965976497,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,8550142229941755171,5900099777243969071,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,9182336740592404627,15394804557639804407,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4728,i,15710100571594889781,3098446386695225233,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,7250883905389830171,18185805006992340985,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,1861222223130324411,4802729972299005731,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,11331850603376370521,7530728399159055441,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,5299778380181232083,14491145823715582464,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,1904653730841987092,5663931112977180613,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5972,i,3557694859216394627,4814288353596550318,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5492,i,17988823477219457784,11615489351287141945,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6212,i,8854121454075481918,8753827317794110985,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6356,i,8952583441472711540,11789235917692107663,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6224,i,8198063599683001065,13652099347261083162,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,11881528424615691272,17481261743120961008,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:6720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,18210456480467435532,18171395246579925301,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
  2⤵
  PID:6768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6936,i,3308108008489771621,9528146298568638817,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:7056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6952,i,13593170456988675229,7574410948853321884,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7052,i,11467439933335578837,2941160462371266440,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:9
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,13629567545254590228,3846963069448589937,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6488,i,4016444591528692056,12691007040207614895,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,4190808874484233840,4298515327792982606,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6460,i,17373423328569662169,15368458924962109942,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:6836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3600,i,92949803689683783,13614137565412367794,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6552,i,5975131817625699922,3091184825804792110,262144 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6124,i,10737826078260041522,18030666347377582162,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5572,i,3761878633786586056,9147362134067021038,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:7112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5612,i,3434250614885614278,15628370036750927704,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3656,i,8184922029231835891,2705218153550860837,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6332,i,13627435609889032487,3458211365676571427,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4712,i,8823179373014916939,5001638445431258820,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,6770306905658018120,9769969732207297036,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,9321531897575871900,9773785667046417277,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5764,i,6054550386501252713,10178366888641467912,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7000,i,17231184596322494609,11850627218933659542,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:6492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6440,i,6364408454448673595,363135180686775452,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5680,i,5305690807186813499,17730385409081061083,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=3648,i,10698547189796601949,7572110849317985478,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6520,i,17259134579421142335,6390966004092019187,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5764,i,7770824651742143388,4769812629846718155,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7196,i,18346801530200215482,6622503872679991470,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,10331667179145017420,9385990455288864950,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:12
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5860,i,12839979494353829525,4946341245920682787,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=4568,i,6549912215571221982,10811777085708311545,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6260,i,5517872814547319604,15038999354656268876,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7456,i,7325722379630874265,17670784879019042554,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:6420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=3136,i,9006242143961392089,8666004264524892464,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7424,i,3254307890299082197,7705467476350926210,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=6872,i,13011875997978471627,7167911092488611902,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6884,i,12921830551663241375,13624442231720411200,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=3648,i,1807219029082161436,4950187625222767567,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=4868,i,10379119959561005272,4250935908080294977,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7836,i,13379425020463376754,16053319437106357418,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7460,i,5756013743595215578,5932919419155895422,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=5600,i,18272323583048494639,7531363787669491001,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7944,i,10298186763428009660,16586184671177755260,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=5844,i,13335301975223712171,15215081491830672657,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7416,i,6199728393962264740,2178558382919751077,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7724,i,10932223513094224342,11747660094189176645,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=8080,i,12339705114851615344,584540594656263682,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=7440,i,11873879603111396813,614039610625134726,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=5956,i,9314660127008741,4023339365747308017,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=8108,i,13782962389401083822,12630440294927953691,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=7580,i,1513681443384439349,4075040504980834283,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=7832,i,8584890967606504648,4108613759385612251,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,8685057439500291490,7162909826856814519,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=6284,i,13861400923740728199,2155743234439695267,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:7048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=5764,i,7457824768154169941,15624573646588135094,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
  2⤵
  PID:6376
- C:\Users\Admin\Downloads\tlauncher-1-9-5-5.exe
  "C:\Users\Admin\Downloads\tlauncher-1-9-5-5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5560
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3970330 "__IRAFN:C:\Users\Admin\Downloads\tlauncher-1-9-5-5.exe" "__IRCT:3" "__IRTSS:26677398" "__IRSID:S-1-5-21-3797332335-34111092-3597280141-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-3797332335-34111092-3597280141-1000"
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe --silent --allusers=0 --server-tracking-blob=Mzg5NTc3MmI5YzMzNzUzZmI1NjBiY2Q1YmFjMWRmMjI1MjU3MDBjYWMxOGEwMjY2YTYyNjhkNWM3MmNkZjQxYzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInRpbWVzdGFtcCI6IjE3ODU3NzgxMDMuOTU3MyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOC4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFHWCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiZDljZjRjYTItMTBkYi00M2I0LWJhNjMtODdjM2Y4MGUyOGY1In0=
        7⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2ac,0x2b0,0x2b4,0x28c,0x2b8,0x7ff7e627cd88,0x7ff7e627cd94,0x7ff7e627cda0
        8⤵
        Executes dropped EXE
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\installer.exe" --version
        8⤵
        Executes dropped EXE
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2092 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_20260803182815" --session-guid=310ec2bc-b788-47c0-a666-214923abdcf2 --server-tracking-blob="NGZkMzBhNTVhY2QyNjI3OTdhZGNlN2JkNDNkMTkwYzBjNzE5ZTY1ZWNiYjc1MTQ5NzJhYTRjNTk2NzNhYzVlNzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4NTc3ODEwMy45NTczIiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiJkOWNmNGNhMi0xMGRiLTQzYjQtYmE2My04N2MzZjgwZTI4ZjUifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC07000000000000
        8⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS40F7A262\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x7ff7e627cd88,0x7ff7e627cd94,0x7ff7e627cda0
        9⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\installer.exe" --backend --initial-pid=2092 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151" --session-guid=310ec2bc-b788-47c0-a666-214923abdcf2 --server-tracking-blob="NGZkMzBhNTVhY2QyNjI3OTdhZGNlN2JkNDNkMTkwYzBjNzE5ZTY1ZWNiYjc1MTQ5NzJhYTRjNTk2NzNhYzVlNzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU1TVEwmdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249T3BlcmFHWCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4NTc3ODEwMy45NTczIiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA4LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYUdYIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiJkOWNmNGNhMi0xMGRiLTQzYjQtYmE2My04N2MzZjgwZTI4ZjUifQ== " --silent --desktopshortcut=1 --install-subfolder=133.0.5932.109
        9⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        Modifies registry class
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff7fd2ccd88,0x7ff7fd2ccd94,0x7ff7fd2ccda0
        10⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --copyonly=0 --allusers=0
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        Modifies Internet Explorer settings
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xa54b80,0xa54b8c,0xa54b98
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant" --run-assistant --allusers=0
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x504b80,0x504b8c,0x504b98
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa34d915a0,0x7ffa34d915b0,0x7ffa34d915c0
        14⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa34d915a0,0x7ffa34d915b0,0x7ffa34d915c0
        14⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x2b0,0x2b4,0x2b8,0x288,0x2bc,0x1128378,0x1128384,0x1128390
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa34d915a0,0x7ffa34d915b0,0x7ffa34d915c0
        15⤵
        Executes dropped EXE
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa34d915a0,0x7ffa34d915b0,0x7ffa34d915c0
        15⤵
        Executes dropped EXE
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --stream
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa34d915a0,0x7ffa34d915b0,0x7ffa34d915c0
        15⤵
        Executes dropped EXE
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_crashreporter.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x174,0x178,0x17c,0x170,0x180,0x7ffa34d915a0,0x7ffa34d915b0,0x7ffa34d915c0
        11⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,7521650968068646069,12647535198369186761,262144 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1972 /prefetch:2
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=1848,i,8675465483946264003,13447054106491307632,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2032 /prefetch:11
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        Enumerates system info in registry
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=2424,i,10032416167601576111,18380948100375214189,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2436 /prefetch:13
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3040,i,462640012351309288,17877332999992048707,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3156 /prefetch:14
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3088,i,12283118281173563741,210799785653651551,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3196 /prefetch:14
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3100,i,12988213033415819433,4119880168821956021,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3280 /prefetch:14
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3112,i,8051909548624819175,604146581051379016,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3300 /prefetch:14
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3124,i,5175794261854470574,5365369875820834815,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3320 /prefetch:14
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=3136,i,18052937266415331107,208750931305549825,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3336 /prefetch:14
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3240,i,2425864992375382418,8389903420832888897,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3356 /prefetch:1
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_gx_splash.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\133.0.5932.109\opera_gx_splash.exe" --instance-name=61C8973803226C4D4008DEBC18682105EDAB1556896BB924D0EEB1B6C96AB147
        11⤵
        Executes dropped EXE
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4676,i,2651314460189002372,6427771642367953625,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4692 /prefetch:1
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4836,i,13087596483652019581,5996940058099775987,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4840 /prefetch:9
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5016,i,15581724973026643460,1993783975892327466,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5028 /prefetch:1
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5152,i,11452507130342185512,6980471929386057048,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5160 /prefetch:1
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --asus-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5188,i,14719881948852267060,4848433792924790419,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5288 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --corsair-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5184,i,8420668250606849653,12532491293422673814,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=4816 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --logitech-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5192,i,13518064171401368146,7893040545907995785,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5776 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.lights.mojom.LightsProvider --lang=en-US --service-sandbox-type=none --enable-quic --razer-lights-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=5300,i,10887747637338264526,3666396578045270435,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6164 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5840,i,8489877066603538547,589783445728281362,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5748 /prefetch:9
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6516,i,10313842432131482919,5146515024475944750,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6552 /prefetch:9
        11⤵
        Executes dropped EXE
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6888,i,11498613522116091460,14516610950618952219,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6828 /prefetch:1
        11⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7072,i,13413059300498436585,1375451609156361011,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=5568 /prefetch:9
        11⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7280,i,7290038794458606767,5833420327725111181,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7256 /prefetch:12
        11⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7436,i,15122810600755219844,14064683598704775192,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7520 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7420,i,11518556139150934208,12069991953010361493,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7480 /prefetch:14
        11⤵
        Executes dropped EXE
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7428,i,14217411832403770554,12477378025164494965,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7500 /prefetch:14
        11⤵
        Executes dropped EXE
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7448,i,17113122379891994656,9551219547857811244,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7540 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7408,i,13986072586911348157,14571762597837193668,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7460 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7692,i,2520604760429809085,14403572207809807714,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8016 /prefetch:14
        11⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7688,i,20187294740667317,18331982226651332322,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8036 /prefetch:14
        11⤵
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7512,i,15763903237336289401,10991777782242717545,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8232 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7680,i,9080375113516096508,12322035409319698226,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7964 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7984,i,17725588563054323967,13346406925035511010,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8424 /prefetch:14
        11⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=7992,i,2923492321145305718,3957553137488151440,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8436 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8164,i,9793356701453616416,15296248264977818734,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=8680 /prefetch:9
        11⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8220,i,11405697463685376235,8133970381609140442,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=8244 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8944,i,15598036383221069327,16991542175698145860,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9552 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=opera.side_profiles.mojom.SideProfilesHandler --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8844,i,7091754644709826918,14798805671779273058,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=8300 /prefetch:14
        11⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8960,i,7839158855249940851,17693434850668227174,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=8060 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=8988,i,14099743645970478024,4471284177533006595,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=9652 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=9604,i,2360624269433867667,16542472323762406612,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=9588 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" --pipeid=oauc_pipeF347B60CA73F3F3DA84B31019F4EB851ECFC332513021FC062CC0CA8D8440B54
        11⤵
        Enumerates system info in registry
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x298,0x29c,0x2a0,0x284,0x2a4,0x7ff652249860,0x7ff65224986c,0x7ff652249878
        12⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --metrics-shmem-handle=10020,i,16908962360274515767,13466345306338590206,524288 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=8164 /prefetch:14
        11⤵
        Enumerates system info in registry
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 OPR/133.0.0.0 (Edition std-2)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:continue-on-booking-cms-configuration=on --with-feature:continue-on-support=on --with-feature:domain-suggestions-vertical-suggestions=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:fun-voice-messages=on --with-feature:gx-post-mortem=on --with-feature:gx-streamlabs-promo-text=on --with-feature:hide-navigations-from-extensions=on --with-feature:image-search-support=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-add-aliexpress-attributions=on --with-feature:session-restore-add-allegro-attributions=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:universal-skip-button=on --with-feature:vpn-pro-v4-support=on --ab-tests=GXCTest50-test:DNA-99214_GXCTest50 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=10316,i,3676514328516663419,3851479310417373077,2097152 --field-trial-handle=1976,i,12194706244362316880,344154297920142392,262144 --enable-features=CertificateTransparencyAskBeforeEnabling,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=AutoPictureInPictureForVideoPlayback,AutoPictureInPictureVideoHeuristics,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=1980,i,12527843343040443520,1058231052453630534,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10376 /prefetch:1
        11⤵
        Enumerates system info in registry
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe" --version
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\b19d066f-7ea1-419d-9878-098a987ba6d1 Opera GX Installer Temp\opera_package_202608031828151\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x268,0x26c,0x270,0x154,0x274,0xa54b80,0xa54b8c,0xa54b98
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3080
  - - C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
      "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3860
    - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
        
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Program Files\Java\jre-1.8\bin\javaw.exe
        
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=windows-1252 -jar C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        6⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:9056
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED --add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.event=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\annotations-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\arns-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-query-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-xml-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\crt-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.268.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\endpoints-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\eventstream-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\filters-2.0.235.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-eventstream-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-client-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.268.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-fluent-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-h2-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\identity-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jackson-annotations-2.13.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\java-image-scaling-0.8.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\metrics-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.282.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\profiles-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\protocol-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\reactive-streams-1.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regions-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\s3-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\sdk-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-api-1.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\third-party-jackson-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-lite-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9371.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9371 -starterDomainAvailabilityV1=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\domainAvailability.json -country=${country} "-starterJVM=C:\Program Files\Java\jre-1.8\bin\javaw.exe" -starterWorkingDirectory=C:\Users\Admin\Downloads -starterJarFile=C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe -starterFileEncoding=windows-1252 -runVersionWithServer=empty
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        System Time Discovery
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:8964
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C "chcp 437 & wmic CPU get NAME"
        8⤵
        Executes a command shell one-liner
        
        PID:9796
        
        C:\Windows\system32\chcp.com
        
        chcp 437
        9⤵
        
        PID:10168
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic CPU get NAME
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:9872
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C "chcp 437 & cmd.exe /c set processor"
        8⤵
        Executes a command shell one-liner
        
        PID:2460
        
        C:\Windows\system32\chcp.com
        
        chcp 437
        9⤵
        
        PID:9968
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c set processor
        9⤵
        Executes a command shell one-liner
        
        PID:10060
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C "chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt"
        8⤵
        Executes a command shell one-liner
        
        PID:9208
        
        C:\Windows\system32\chcp.com
        
        chcp 437
        9⤵
        
        PID:10180
        
        C:\Windows\system32\dxdiag.exe
        
        dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt
        9⤵
        Drops file in System32 directory
        Checks SCSI registry key(s)
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5880
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C "chcp 437 & wmic qfe get HotFixID"
        8⤵
        Executes a command shell one-liner
        
        PID:2036
        
        C:\Windows\system32\chcp.com
        
        chcp 437
        9⤵
        
        PID:2060
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic qfe get HotFixID
        9⤵
        
        PID:8496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=4588,i,6585050372980110988,11614386488033984485,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:1
  2⤵
  PID:8380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=4488,i,2825760207456942499,7500644081948876088,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:9868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=8124,i,5081016116983044403,2774710259805894669,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=3716,i,17559020860449886882,15152309643200958808,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:8896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=4580,i,3597504599269210312,12010411256408675063,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=6672,i,7035530928865890876,17717416163308405137,2097152 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8080,i,10518623003476709193,13284146343446595220,524288 --field-trial-handle=2008,i,18374346790955148148,11500991602260503253,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:9332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1336

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5800

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:1672

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4076

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:6924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:3872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7084

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:4144

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:6624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:3364

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:7940

C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
"C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe7FAE56220944838BCDB933E86AD23A432FE91C0ADA84DF94778C72EE141B2B1F
1⤵
- Enumerates system info in registry
PID:8696
- C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
  "C:\Users\Admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x294,0x298,0x29c,0x22c,0x2a0,0x7ff652249860,0x7ff65224986c,0x7ff652249878
  2⤵
  PID:8444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:9184

C:\Windows\System32\PickerHost.Exe
C:\Windows\System32\PickerHost.Exe FirewallNotificationDialogServer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7200

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\TestStop.potm"
1⤵
PID:5800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:8940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x9c,0x134,0x7ffa5e1fc728,0x7ffa5e1fc734,0x7ffa5e1fc740
  2⤵
  PID:9084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,835915143278897523,1851192049170057676,262144 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:8884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,18033869966553410794,2185832188184676610,524288 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=1952 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,8815593018163996302,18339637324067360957,524288 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,10935427491512739177,15122494070945143752,2097152 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,12993695464145171082,6747695366051864816,2097152 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:8992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,16460203845685910385,16676497934994005370,2097152 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:9164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,7835708286601234265,4012250765394484678,524288 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,16522842981623330160,10684498394647637224,524288 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:8052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,17090509766951604473,11652796653240667263,524288 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,11477100798297864953,13110822279511257781,524288 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:6848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5432,i,13246517327710736657,14896426506112238310,2097152 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3604,i,14352322230549410455,12829805935664726175,2097152 --field-trial-handle=1804,i,15108070709762827734,16634107905904247656,262144 --variations-seed-version=20260803-010036.294000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4696

C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
"C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE"
1⤵
PID:352

C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
"C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE"
1⤵
PID:7512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery