Analysis
- user interaction
yes - max time kernel
899s - max time network
889s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
11/10/2026, 10:59
General
- Target Lunar Client - Installer.exe
- Size 3.1MB
- Sample261011-m3jqmsgf45
- SHA256 cb44e31c7eb744aa9deb0bb5f64173d7dc2f34a3eb90278d6f3a45cab1a432a5
Score
7/10
Malware Config
Signatures
- Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs
A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
- Adds Run key to start application 2 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file 2 IoCs
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 16 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 64 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 56 IoCs
- Suspicious use of SendNotifyMessage 18 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe"C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe"C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe" Sel=0&Extension=jilehohlakeokncafogkgnicgndeecdiengddbcc&UtmSource=client-site&UtmMedium=download-page&UtmCampaign=direct&Referer=www.lunarclient.com&Browser=chrome -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://launcher-releases.lunarclientprod.com/master/6e18b5a4f4ebbd4c7ecff572f1700cedce1f248bcb157adce5ec49be9e081a23/latest-ow.yml -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://www.lunarclient.com/terms --privacy-url=https://www.lunarclient.com/privacy --silent-setup --app-name="Lunar Client" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\DxDiag.exe"C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=4384.2108.13548684232390320413⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x120,0x7ffac3c1b078,0x7ffac3c1b084,0x7ffac3c1b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1680,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2000,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2252,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3560,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4020,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1020,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4824,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5008,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5076,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4444,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4728,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4356,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5052,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5088,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4360,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nso6761.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.310.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5112,i,16587542471101970643,13953307243554696329,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:144⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac367c728,0x7ffac367c734,0x7ffac367c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,4573620808977169140,18294032601668777354,262144 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1968 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,4247613704288452384,12657195938233171382,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2240 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,3885460776642286988,2428349926978753871,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2540 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,3785512729424899923,11808143052909366140,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3108 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,11065915809564786748,15376542603262120919,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,3185564223369522625,15266576331843032812,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4296 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,3895776572459529550,1811563705703440546,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,18152836419315055314,6906554596401616337,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5536 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6040,i,8909990540095605942,9458578768603900870,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6024 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5992,i,6666100036577376946,11355620979467377284,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3128,i,6112384454947312574,4115717485312709377,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6000,i,1727353247499531210,1740575710367782187,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3412,i,4052933331443087812,16557153442144056909,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4764,i,8202142804514939559,2835441183671681347,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3496,i,8259426758760346876,16751540486308839417,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3324,i,4546306364706711102,4919358710994888983,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6324,i,1318908433152311401,18309688158151383386,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6188,i,106887063808823788,7193461851811557240,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,11818023904494786827,3380153269717195418,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6504 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2916,i,14755634422412794474,3179618823006220491,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6516 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,7409179221191829555,4965678045697148675,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3908 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6552,i,10608508190849324562,11227307508889203389,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6248,i,5519138215080458252,14186200670634766377,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6332,i,3710948318734124871,17222709256047742970,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4300,i,4661003491351669821,873475949480419447,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5852,i,3743907603938801593,9463889401427498226,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5940,i,1273352506383537911,2708885961967886868,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4396,i,3746124130318278075,15548999033934920489,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6028 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6232,i,14648587696790197386,3301984713666173168,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5492,i,14591687715885366819,6188394473916520750,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6004,i,4144544990244087622,6058525592837970493,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4328,i,2088718069902223396,17913274397539320107,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6332,i,9056761515748853192,11992680772582783829,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5776,i,4503033771467340127,1652045699832269585,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6100,i,15488888811751536616,8034059870294944717,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6988,i,2828672729474589660,15976411096990801410,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5968,i,6842917235552093644,3562689149884176134,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3372,i,164954781053148555,17520627571223594433,262144 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6348 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6812,i,553969293829107305,5908680343582229862,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7008,i,2410728211546987493,7069330584208073628,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=5668,i,10061267090951931695,15668584750387990424,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7132,i,8268998726505607654,16004429260603616471,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7340,i,3387710546348655961,1275782579128599991,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6832,i,16441539465834692387,16346962546777021378,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7568 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7536,i,4008060219033422940,4500066227614480661,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6864 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=1476,i,5345868274834038102,4406129165671344472,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7344,i,9482662260003343845,2346746493800648833,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7432,i,5549687066224894939,2965200658719607282,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6724 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7764,i,18381507201352181694,17141299403093000557,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7804 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8100,i,17589822011972702833,10609693464793574996,524288 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=8088 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7484,i,4869703317821201333,10482849750678083504,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=4376,i,5812273719754069067,16347287919033705656,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7160,i,14960035406195206347,10795759740240942003,2097152 --field-trial-handle=1976,i,10706854285188749000,6104929144616367088,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=7524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\OperaInstaller.exe"C:\Users\Admin\Downloads\OperaInstaller.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\OpInst.exe"C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=YTU3NWRlMDA4N2U5YzhjYTc1ODAzODY3MTE5ZmIzYzM2YjMzMmZmYjVkYzUxN2M0NjYyZTQ2NGU5N2UzZDkyNjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmcmdXRtX2NvbnRlbnQ9NjEyNjM0IiwidGltZXN0YW1wIjoiMTc5MTcxNjk2NS45MTkyIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InZpZGVvLXN0cmVhbWluZyIsImNvbnRlbnQiOiI2MTI2MzQiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMmUzNjhkZDQtNmY5Yy00ZmIzLThkNzgtNjY1N2VhYjRhMTczIn0=3⤵
- Enumerates connected drives
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x298,0x29c,0x2a0,0x25c,0x2a4,0x7ff76c3609d8,0x7ff76c3609e8,0x7ff76c3609f84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\installer.exe" --version4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exe"C:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4752 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_20261011120926" --session-guid=53ec729a-af45-4051-9728-2f137ab1a555 --server-tracking-blob=MjM0MzlhYWExN2I1Mzk1M2NjZDMxYjExYWVlZGRkNDYwNWM3MWEwZDMzMWUzZjQ1MmYzMDEyNTY0NTVmYjBkMTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmcmdXRtX2NvbnRlbnQ9NjEyNjM0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkxNzE2OTY1LjkxOTIiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoidmlkZW8tc3RyZWFtaW5nIiwiY29udGVudCI6IjYxMjYzNCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiIyZTM2OGRkNC02ZjljLTRmYjMtOGQ3OC02NjU3ZWFiNGExNzMifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F4070000000000004⤵
- Enumerates connected drives
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS073E688B\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x28c,0x290,0x294,0x268,0x2a4,0x7ff76c3609d8,0x7ff76c3609e8,0x7ff76c3609f85⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe" --backend --initial-pid=4752 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261" --session-guid=53ec729a-af45-4051-9728-2f137ab1a555 --server-tracking-blob=MjM0MzlhYWExN2I1Mzk1M2NjZDMxYjExYWVlZGRkNDYwNWM3MWEwZDMzMWUzZjQ1MmYzMDEyNTY0NTVmYjBkMTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmcmdXRtX2NvbnRlbnQ9NjEyNjM0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzkxNzE2OTY1LjkxOTIiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoidmlkZW8tc3RyZWFtaW5nIiwiY29udGVudCI6IjYxMjYzNCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiIyZTM2OGRkNC02ZjljLTRmYjMtOGQ3OC02NjU3ZWFiNGExNzMifQ== --silent --desktopshortcut=1 --install-subfolder=137.0.6036.395⤵
- Enumerates connected drives
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff6789509d8,0x7ff6789509e8,0x7ff6789509f86⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=06⤵
- Writes a Windows system DLL name to a user directory
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xa8c9cc,0xa8c9d8,0xa8c9e47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=07⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x81c9cc,0x81c9d8,0x81c9e48⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x25c,0x260,0x264,0x258,0x268,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e4810⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x258,0x25c,0x260,0x254,0x268,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e4810⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7f7324,0x7f7330,0x7f733c9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream10⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x25c,0x260,0x264,0x258,0x268,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e4811⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x258,0x25c,0x260,0x254,0x264,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e4811⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x258,0x25c,0x260,0x254,0x264,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e4811⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\de932af914ba00303d4a2778a383ac9c831101e2.crx"6⤵
- Adds Run key to start application
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x258,0x25c,0x260,0x254,0x264,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e487⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2120,i,14787462000786488432,12824826263340970161,524288 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2128 /prefetch:117⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Time Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1676,i,3840978748139504170,11193484223251178853,262144 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2012 /prefetch:27⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2440,i,12830027592891254381,17282070266250275209,524288 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2532 /prefetch:137⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3628,i,18160263242985744108,14479653629798362253,1572864 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3640 /prefetch:97⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4348,i,11133960207506120107,3789091481592797428,524288 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4376 /prefetch:147⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4416,i,17529595920244139390,9247646669314645068,1572864 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4460 /prefetch:97⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4308,i,7134176565800361604,5620840394594888296,524288 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3596 /prefetch:127⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4364,i,1090615144791413030,13067046895780913173,524288 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4828 /prefetch:147⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4968,i,14319197554339440171,2970694396947650278,524288 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4812 /prefetch:147⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5140,i,4700423795507974210,5087129083539424000,1572864 --field-trial-handle=2032,i,12202172298821561138,11890948505709218589,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2044,i,16103069880907804955,3965298597247641902,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5188 /prefetch:17⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized6⤵
- Adds Run key to start application
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x258,0x25c,0x260,0x254,0x264,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e487⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1692,i,13563112027484734206,6224263726176477933,262144 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2064 /prefetch:27⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=1984,i,15923845741243075011,4338176999562386194,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2100 /prefetch:117⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Time Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2528,i,8651755128184140056,6423676753299982445,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2720 /prefetch:137⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2364,i,10707220609691961664,858603656492654208,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2948 /prefetch:147⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2976,i,15780930072649869665,11766420051912757753,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3064 /prefetch:147⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3052,i,14140377925871877149,14925640597608819983,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3168 /prefetch:147⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3040,i,7954712123272595682,5312081032457441380,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3148 /prefetch:147⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=2988,i,9595664501650417316,18271037858985191169,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3088 /prefetch:147⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3000,i,446243341224116771,14642196714485256892,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3108 /prefetch:147⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3028,i,5892022385212661133,14892625282603916306,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3128 /prefetch:147⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3460,i,14419828766934602708,13476138843505634004,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3488 /prefetch:17⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_gx_splash.exe"C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_gx_splash.exe" --instance-name=62918497600F2E2DAF77EF23BF7DF68528BAE39ED3F6DE8A384301C64F4D5C967⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4760,i,9762392645013038803,510307539372491466,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4772 /prefetch:97⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4936,i,10635576072345992686,12723206062041032614,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4940 /prefetch:17⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5192,i,6641654528005213189,64511051431122806,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5200 /prefetch:17⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5272,i,16513634936263739263,14489855222226631183,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5288 /prefetch:17⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6324,i,7769655400600274131,15551830846213600173,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6352 /prefetch:97⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6552,i,3109900145082940626,3918693091966924243,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6816 /prefetch:97⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6316,i,15912059130182081724,5134373506174750142,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6340 /prefetch:127⤵
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6928,i,2489681133905462535,4830587657324589695,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6724 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6288,i,4424893872110686199,6429711523407635177,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6996 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6980,i,5070658572381748613,14180301636899510415,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7076 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6736,i,1796763649579120550,13041973878921238537,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7016 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6956,i,8962556048345420677,7720269494341675345,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7056 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6964,i,7453033874411498514,6249960362692008280,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7036 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7444,i,13243079196629408368,7094997188906147436,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7500 /prefetch:17⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7424,i,5334944856603090191,18329949239577548130,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7592 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7764,i,14524724591687198697,3391505858029932475,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=7780 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7196,i,2282597223127460529,2627346691410873922,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7616 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7820,i,11724318129108572285,15011419956571093573,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=7804 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7528,i,2769097994465259186,2318239359608965697,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7656 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7792,i,12259907749714838685,6652137791290835995,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=7868 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7800,i,10859688649617684195,7987908653857683309,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=7848 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=8128,i,3415552779016803173,240291202325459414,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=8176 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8208,i,11542329521910562200,15076816567850308562,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=8324 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7548,i,12327978565248435223,2293903477427141785,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=7696 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8380,i,14878619467096015506,15228567032518942062,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=8296 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7536,i,3379728152254036732,6520644890796166149,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=7676 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7508,i,25696183785800229,4694351969235048771,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7636 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7700,i,11987142806030833634,13141600149844094933,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=8524 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7560,i,17560353652610858808,12876603754813801636,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=7716 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7572,i,1290879832959941900,6785391200876401553,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=7736 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9792,i,11186680299710181299,5486506560652702102,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=9920 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10088,i,9533897525796478890,8099051385299650582,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10064 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10228,i,13812602322603105772,15082900980563339011,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=10276 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10864,i,1024615812945945392,2352613410743486201,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=10280 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11212,i,4873418975391841824,4010090631520051572,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11200 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11364,i,5908444386560499477,1301235616173091713,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11376 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe829C77C52C50D24864A73C891B28976EA11A30DB7D0D3F744418ADB97BE7F1617⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff6aa468598,0x7ff6aa4685a8,0x7ff6aa4685b88⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=11616,i,15964822812126751468,10070874818339633096,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=11668 /prefetch:17⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11348,i,980044802618781184,12119826314258259352,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=11324 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11936,i,6474888466611825782,18215214318970178062,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=11948 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6396,i,5356165987508366296,16489918853188641602,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=7508 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=6412,i,3532182310996067426,13935237021064627983,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=6424 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9644,i,11916305896489452657,368158523722980117,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=9616 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=10716,i,12111088229137667040,9755648387847068843,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=12236 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11432,i,9301333538744451256,6194998681333259204,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=11420 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=7148,i,18333921116061535965,14182945727366336706,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=4456 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12220,i,6471223810173929500,3276498551995801445,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=10648 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11476,i,18061205068995361220,10272091623143873600,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=12156 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12180,i,17511619858261494058,5493797088154382505,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=11444 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=12176,i,2643897409451217797,4399174805854339402,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=11472 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=11932,i,16125280791985660503,10782414481331718318,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=11348 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12216,i,1415665159564001314,8067988672690801084,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=11488 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3512,i,6694750479726460010,18222715057429979952,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=4448 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9404,i,408997223575238850,17357318581648666651,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=10284 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8188,i,11578298322549387776,4807168645479095648,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=9116 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=7144,i,5865092963401002541,13954045711813532822,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=11376 /prefetch:97⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=7800,i,11900353732847671979,5008678668018171390,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=9668 /prefetch:97⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=9620,i,4530841305414630567,7386356191172280920,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709052841842773 --mojo-platform-channel-handle=7636 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=3068,i,16804583645096477324,17582497843807384263,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709053778884622 --mojo-platform-channel-handle=8400 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=800,i,6410054810728035868,6457552428149307078,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709054715926471 --mojo-platform-channel-handle=7800 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=9632,i,259505851399472261,16873327839070671729,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709055652968320 --mojo-platform-channel-handle=7148 /prefetch:97⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=800,i,465360887455037562,7202346582882812717,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709056590010169 --mojo-platform-channel-handle=12164 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=7648,i,10889299005512576762,17341184279134097081,262144 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709057527052018 --mojo-platform-channel-handle=7144 /prefetch:107⤵
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=6360,i,18076788412948801070,16394491871059133316,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709058464093867 --mojo-platform-channel-handle=12036 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=12180,i,11452383808499170937,4365034868314940476,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709059401135716 --mojo-platform-channel-handle=9632 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=11348,i,17589042913320766531,12894624139848619490,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709060338177565 --mojo-platform-channel-handle=12000 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=9604,i,15580681209045945646,1351400940480124052,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709061275219414 --mojo-platform-channel-handle=6408 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=4948,i,15537996476285566155,5890159269926345675,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709062212261263 --mojo-platform-channel-handle=9988 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=8588,i,2701562304220531856,14493373270197968069,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709063149303112 --mojo-platform-channel-handle=8584 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=8600,i,1256847509334326943,7565966482102081578,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709064086344961 --mojo-platform-channel-handle=8088 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --metrics-shmem-handle=11496,i,764422103311079356,11894723739999421066,524288 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709065023386810 --mojo-platform-channel-handle=4460 /prefetch:147⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=11428,i,5404874407647460449,3601589101581130279,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709065960428659 --mojo-platform-channel-handle=8600 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=8604,i,519624681149046264,12461389066484343441,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709066897470508 --mojo-platform-channel-handle=4460 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=8556,i,9386527312985965097,10757929268371463457,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709067834512357 --mojo-platform-channel-handle=7884 /prefetch:97⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=8356,i,16201767058171046766,108692461514376536,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709068771554206 --mojo-platform-channel-handle=10024 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=7920,i,14433080412550466449,3018295308256656160,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709069708596055 --mojo-platform-channel-handle=11448 /prefetch:97⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=12068,i,8575490809876222753,11084657880367698801,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709070645637904 --mojo-platform-channel-handle=1248 /prefetch:97⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=11580,i,2279538280111588272,6840298967089121246,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709071582679753 --mojo-platform-channel-handle=9608 /prefetch:97⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --version7⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x25c,0x260,0x264,0x258,0x268,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e488⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --with-feature:acceptable-ads=off --with-feature:address-bar-dropdown-keyword-ads-reduced=on --with-feature:audio-analysis=on --with-feature:cashback-assistant=on --with-feature:certificate-transparency-enforcement=on --with-feature:cms-restore-attribution=on --with-feature:domain-suggestions-confidence-scoring=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:installer-experiment-test=off --with-feature:installer-move-opera-exe=off --with-feature:installer-verify-ipc-client=off --with-feature:new-auto-pip-for-documents=on --with-feature:new-auto-pip-for-video=on --with-feature:opera-one-unskippable-introduction=on --with-feature:opera-startpage-special-2=off --with-feature:proxy-switcher-ui-default-visible=on --with-feature:run-at-startup-default=on --with-feature:session-restore-add-amazon-attributions=off --with-feature:session-restore-add-booking-attributions=off --with-feature:side-panel-api=on --with-feature:sidebar-update-notification=off --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:startpage-sync-banner-ref=on --with-feature:translator=on --with-feature:vpn-pro-v4-support=on --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=11576,i,5847437933572959925,7659652125002603153,1572864 --field-trial-handle=2068,i,6392517435129823401,14657559257780767964,262144 --enable-features=AutoPictureInPictureVideoHeuristics,CertificateTransparencyAskBeforeEnabling,ExternalDecoderInAudioFileReader,MultiThreadedUiCompositor,NativeNotifications,SystemNotifications --disable-features=BrowserInitiatedAutomaticPictureInPicture,ExtendedDWCCollection,GcmStoreSelfRepair,SkiaGraphite,SyncWorkspacesInSessions --variations-seed-version --pseudonymization-salt-handle=2072,i,6984214103546484667,14071491278575892955,4 --trace-process-track-uuid=3190709072519721602 --mojo-platform-channel-handle=6356 /prefetch:97⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\Assistant_136.0.6008.52_Setup.exe_sfx.exe"4⤵
- Writes a Windows system DLL name to a user directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\3237eb09-4c80-461b-9f3f-4d7353cd6d27 Opera Installer Temp\opera_package_202610111209261\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.52 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xa8c9cc,0xa8c9d8,0xa8c9e45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --autostart1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\137.0.6036.39\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x258,0x25c,0x260,0x254,0x264,0x7ffa968d1e28,0x7ffa968d1e38,0x7ffa968d1e482⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --requesttype=automatic --scheduledtask --pipeid=oauc_task_pipe8568FD7CD38622B8DFBB9DE3BFCE1D28A3A1856C28EF1A9FCC4C666E10A82BC11⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=137.0.6036.39 --initial-client-data=0x280,0x284,0x288,0x218,0x28c,0x7ff6aa468598,0x7ff6aa4685a8,0x7ff6aa4685b82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Hijack Execution Flow
1DLL Search Order Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Hijack Execution Flow
1DLL Search Order Hijacking
1Defense Evasion
Direct Volume Access
1Hijack Execution Flow
1DLL Search Order Hijacking
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
1125a226-873e-489b-a005-11ad9eb5841a.tmp
3ef76be0-f657-4575-9c9f-ce9e1b8a9099.tmp
5d372cb1-2ccf-41d0-a560-285936747488.tmp
9b69f1be-1e5f-48e9-8573-59e3b11607df.tmp
settings.dat
0240d9aa-27c6-48f1-80fb-ee68f3a8d224.tmp
1023bfd2-4ba8-4324-b5c8-9e30b19d5dae.tmp
1e5033af-e0d4-41b3-a722-0691447da060.tmp
276b2637-c492-424d-81a0-3b95d9a055e7.tmp
2b502608-bbce-4c88-98c5-7ef39bdf6292.tmp
35dec7ac-9808-4025-ba6f-27ed2492a94c.tmp
41284a29-7e98-4a94-9a1d-f598b6d07afb.tmp
493d31d9-3fe6-48d4-a01c-7368ef318890.tmp
5f7922ab-efff-4d62-83b7-31f4fb81cd30.tmp
8fc6db74-7430-4696-896f-9c46cd229a08.tmp
f_000005
f_000008
f_00000a
f_00000b
f_00000c
f_000010
f_000012
f_000015
f_000016
f_00002b
f_00002c
f_00002d
f_00002e
f_000030
f_000035
f_00003f
f_00004d
f_00004e
f_00006e
f_000073
f_000074
f_000075
f_000076
f_000077
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_00007d
f_00007e
f_00007f
f_000080
f_000081
f_000082
f_000083
f_000084
f_000085
f_000086
f_000087
f_000088
temp-index
temp-index
temp-index
temp-index
temp-index
1319d7d7-7686-4f45-a33d-cd019c2a1fde.tmp
82bfaa2b-22aa-41c2-aa33-df7529c87b61.tmp
91afc799-1d32-44bf-abf4-32fe96965bad.tmp
ad045be9-551b-41cd-9343-85f62e30dc28.tmp
dfb58862-0741-42f8-8c55-a071bde9efdc.tmp
e2583d82-98ee-4205-9dd5-c5f57f41f4cf.tmp
ea863730-0552-49a1-b777-d13aeef318e0.tmp
f02cf94b-7afa-4ce3-8eff-a973164bdc94.tmp
temp-index
the-real-index
temp-index
00000000
.usage
index
index.txt
index.txt.tmp
a9d4ad71-9e1d-4649-b45f-12097c73a05c.tmp
ca690890-34c8-43a1-bdbc-ab125ef44496.tmp
d0aeb565-fd24-4dbc-8f83-184166a965ac.tmp
d19ecec5-7151-4be1-8cda-bf5134f49c03.tmp
d40f0505-0862-44d3-8c3f-d95fc05d2598.tmp
Local State
Local State
ba2dd4ea-1e56-4896-9286-1b9e4690e8cc.tmp
ba839d23-c6d8-4ad1-a825-51c5c7516924.tmp
c345d115-67d0-4e24-b9d7-63768cbd5d57.tmp
cd4ddeb7-6286-47b2-a979-7f1a88c7a783.tmp
cddb917d-1751-457e-abc6-842f2c12a19c.tmp
dcf26239-c2f8-454a-a1e7-24a9bdc473bd.tmp
snapshot-new.baf
f_000001
SettingsPageBasic.xml
browser_assistant.exe
opera_autoupdate.exe
installer_prefs.json.backup
installer_prefs.jsone165cad7-539e-4ace-b82f-c9740ca8526e.tmp
opera.exe
Opera Browser.lnk
additional_file0.tmp
assistant_installer.exe
de932af914ba00303d4a2778a383ac9c831101e2.crx
installer_prefs_include.json
installer_prefs_include.json63afa401-d2ff-4f16-9344-a89078cc686b.tmp
installer_prefs_include.jsonff03fc5e-b38e-47c5-9302-d55fcc99eb39.tmp
installer.exe
installer.exe
OpInst.exe
aa812a3f-3b01-4112-a8e9-7c180e701eb6.tmp
bg.png
e01e29b4-44f9-4196-b2fa-eda2248bd5fe.tmp
CommandLine.dll
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.WinForms.dll
Newtonsoft.Json.dll
OWInstaller.exe
095d44e3-ecf6-455c-83b9-81f3ee4e8a56.tmp
13c842c0-fe5d-441e-8312-b29ca979dce9.tmp
6195ff4b-98f6-450b-b91c-7dcd559ea505.tmp
72ce1ea6-4436-4b26-8dad-9727bee243e8.tmp
74ababc6-292b-4599-93fd-168113b3137f.tmp
manifest.json
settings.dat
settings.dat
throttle_store.dat
76d99874-c31e-48a7-ae8c-a598782ec4aa.tmp
f_000001
temp-index
the-real-index
data_0
data_1
data_2
data_3
Network Persistent State
c513b6dd-05ad-47da-bb29-9b4be12fb58f.tmp
Preferences
MANIFEST-000001
CURRENT
Local State
manifest.fingerprint
manifest.json
manifest.json
manifest.json
manifest.json
Other
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
OWinstaller.exe.config
OverWolf.Client.CommonUtils.dll
SharpRaven.dll
System.dll
UserInfo.dll
WebView2Loader.dll
icon.ico
index.html
app.js
block_inputs.js
cmp.bundle.js
notifications.js
analytics.js
commands.js
cookies.js
modal-events-delegate.js
strings-loader.js
utils.js
cri-controller.js
template.js
cris-controller.js
template.js
finish-with-recommended-app-controller.js
template.js
finish-controller.js
template.js
main-controller.js
template.js
modal-controller.js
privacy-controller.js
template.js
progress-1-controller.js
template.js
settings-controller.js
template.js
template.js
welcome-controller.js
manifest.json
log4net.dll
uac.dll
utils.dll
InstallerTrace_2026-10-11_12-05_4384.log
1423.js
1622.js
1904.js
2343.js
2667.js
269.js
3168.js
326.js
3624.js
3642.js
3937.js
395.js
3995.js
4294.js
4398.js
4583.js
4669.js
4688.js
4730.js
4829.js
4958.js
511.js
5336.js
5428.js
5570.js
5649.js
5907.js
6046.js
6166.js
6214.js
6260.js
630.js
6777.js
685.js
6980.js
7090.js
7103.js
7219.js
7390.js
7946.js
7997.js
8122.js
8345.js
8395.js
8671.js
9025.js
9028.js
9135.js
9432.js
951.js
9600.js
9736.js
9794.js
9844.js
9901.js
aria.html
aria.js
018d39b3bdda8041.png
045499a2e328133d.svg
0561eac25d821104.svg
059e8a27e58989ac.svg
0647aa53f7a1ab03.png
07e5916f8c42413d.svg
0c065981a363e375.svg
0c31e8f306b5f2d6.svg
0cbcfc6fe4cb443b.svg
0d0d0fdaeacb5e45.svg
103eff58785ab58b.svg
1046c13174d8b145.svg
123ab2cc0ee9e515.svg
12e3fff4ce882c02.svg
14e91cb3dc3fa6da.svg
1670e5d31a4fbef2.svg
1688c4091f2a2e26.svg
17cbd66168518049.svg
181d51d89dd58b1c.svg
18b4316285d3185b.svg
1c9159e6d6d5b88c.svg
1c94572b8a82384e.png
1eb51cb7434ba396.svg
1f8c89981dfc2af2.svg
2108d437d813d94a.svg
211b3eed2dc9a97b.svg
22d2121364e44949.png
243e789a53847976.svg
253f1599e4c715f7.png
2dfdd8918d195c58.svg
2edf079df2181fc4.svg
2f4d0c616cea0666.svg
31ba446b2ad075f0.svg
33bd9ebd264104a0.svg
3607fe7f996c064b.svg
36bf914fc5de6f1a.svg
37192a2a129f5ff9.svg
3a2ea7738b340340.png
3b9545916efb17d9.png
3c91fce8ee8453fd.svg
3c9e7cbca1e6a295.png
3cc0c6f21a6016be.png
3d5e7395e9ffbdbd.svg
3dad3b5da9993b6c.svg
40da13d190d51b3d.svg
436b779e283e4cec.svg
467465eb8fa50b5b.png
48d7ceaf46faf1a6.png
49c99c607978a8f1.svg
49f7d977039c303e.svg
4a39a099362c32de.svg
4a903e15f57d70f2.svg
4cad3768b65a46fe.svg
51f491f244f5f86b.svg
52630788a25809fa.svg
535cb5713fe4ca16.svg
53d73708b13075be.svg
578e94e35aa16d97.svg
581fa70608c7fb8c.svg
5bddb929efb23217.svg
5d5360751452a836.svg
5d690726b5ef06db.ttf
625b924eeceb153e.svg
62b733d362f51663.svg
62dc31e3f318054a.png
6327ab0f8e3c16d7.svg
634f72a779327aba.svg
692666c0b9f55408.svg
6b1f3d57b04e487d.svg
6e3ebbcd0a39edc2.png
6e6472b3e10aeb93.svg
6ef20e0ce2751205.svg
6f76682df45e26ec.png
700fa70309836a11.svg
7179a1df5787b209.ttf
717cc4781a98e1ef.svg
72c1fd3caec7d678.png
72db340eafb58783.svg
74ab371d1003b3d3.svg
74ef97b398a3165f.svg
77a9dc64dd93830f.svg
77d97894772b8d2f.svg
791eead8725e14fa.png
7bc841d9002787a9.svg
7e16ca1274952ee7.svg
7e28f70725b144c5.webp
7fe0482b83201fc0.svg
809a1e218234bed0.svg
823861837143cdc9.png
833aa64d0b4e0fae.svg
83a9049d6e0cae5a.svg
85004375da840fda.svg
86235b4464b5fafd.svg
869ca107851f570d.png
86f46fb860e9ed7a.png
878f446ee6de2255.png
87dc241b2c0177c7.svg
881503b944af06d9.svg
885856d657cdfb17.svg
896669c7450ccc86.png
8987293ae7ba4469.svg
8a62bca7498ca4cb.svg
8bf0bcc9a3301fbb.svg
8bf79756f58263e4.svg
8e2cf4504754d310.svg
91ede6982d00ebc1.png
931d0abe7a9ac97b.svg
96cc5bea8cfdcdd1.svg
96fa9a8683ad0a32.svg
97e3abd934c12f4e.svg
982d29750cf2efe8.svg
9a23d988229f3c4f.svg
9b5ed63ba06f1f6e.png
9b8afed344c17eb7.svg
9fc4cb3c560c02fe.svg
9fd27840422642a9.svg
9fe4e4ead173d4dd.svg
a0ee19f03b9940aa.svg
a1a3ecb5c68b205c.svg
a49ea8daf7467bb0.svg
a58a2e93a4b54988.svg
a658c46672ad28f5.svg
a7a18b10642bfd5f.webp
a7dbf1405144b262.svg
ac28779d03531772.svg
ad827c7ddb8dd0cb.svg
ae846f7eddd04278.svg
aeba9f15ecf7f43b.svg
af5f97cd7e418012.svg
b294d3d2f70d508c.svg
b37bf551ac569d00.svg
b4e5db2f8e466503.svg
b631c209ab478391.svg
b80fc20fe385bc09.svg
b87ddd7d399ff7d2.svg
b8ddd3b0a5acfb1f.svg
b970e42cf2658a8e.png
b9e2526d946fd3cd.svg
ba9bf1c3957e59f0.png
bc4e54d6f0276d36.svg
bccd629ae7cb011d.svg
be50ce6d9253a5a9.png
befe724adae4279e.svg
c01afd7dfd61f804.svg
c2975b0d0a40a4fd.png
c3c4018a4fd62a9a.svg
c57ac42a27678f77.png
c5e2e5518ff4a597.svg
c5ed42bd4f1a6974.svg
c6b3624b8cf9684a.png
c7c6749d23d7b7f6.svg
ccdd22e861d21d30.svg
cf9e121c611b5d0e.svg
d05dd34996b64d16.svg
d065dd41270e47f7.png
d28440c6dc230bf9.svg
d2cf554ccc93ffff.svg
d2e19878110efee6.png
d46d147daa1d2f79.svg
d59a1307c364439b.svg
d78ba875312ee059.png
d7dc8f3dc0f234e6.svg
d841f4bcced2e8bc.svg
d897a6873296312d.svg
d9b97322b3dc4aee.png
dcbb2fc627b41963.png
defebccb46e071fb.svg
df04cc6b3471fe0f.svg
dfcd56774003574f.svg
e0355e3bf0f86483.svg
e0753f4e4fd1f172.svg
e117838d3c5eda37.svg
e337c07cfdb9efce.svg
e8a8ba696fae21e8.png
e8bb6bfbe58f9668.svg
e95ff90adab8dab9.png
ecc19831f5fd7269.svg
ee302686425de6d1.svg
f0c9814d841afa42.webp
f156fe54a5a79b77.svg
f3bcc22345312f8d.svg
f45cbb00d6bb82cc.svg
f515140b598dd3f7.svg
f7b78d9433c9d476.svg
f7fc539ce7a13719.svg
f8695cbe3a95268b.svg
f907caea9dc5c5af.svg
f95f5a575299231b.svg
fc431416b1024934.svg
ff8d935c2abdcdac.svg
blacklist.js
common.js
devtools.html
devtools.js
favicon_opera_one.png
favicon_opera_one.png
KaTeX_AMS-Regular.ttf
KaTeX_AMS-Regular.woff
KaTeX_AMS-Regular.woff2
KaTeX_Caligraphic-Bold.ttf
KaTeX_Caligraphic-Bold.woff
KaTeX_Caligraphic-Bold.woff2
KaTeX_Caligraphic-Regular.ttf
KaTeX_Caligraphic-Regular.woff
KaTeX_Caligraphic-Regular.woff2
KaTeX_Fraktur-Bold.ttf
KaTeX_Fraktur-Bold.woff
KaTeX_Fraktur-Bold.woff2
KaTeX_Fraktur-Regular.ttf
KaTeX_Fraktur-Regular.woff
KaTeX_Fraktur-Regular.woff2
KaTeX_Main-Bold.ttf
KaTeX_Main-Bold.woff
KaTeX_Main-Bold.woff2
KaTeX_Main-BoldItalic.ttf
KaTeX_Main-BoldItalic.woff
KaTeX_Main-BoldItalic.woff2
KaTeX_Main-Italic.ttf
KaTeX_Main-Italic.woff
KaTeX_Main-Italic.woff2
KaTeX_Main-Regular.ttf
KaTeX_Main-Regular.woff
KaTeX_Main-Regular.woff2
KaTeX_Math-BoldItalic.ttf
KaTeX_Math-BoldItalic.woff
KaTeX_Math-BoldItalic.woff2
KaTeX_Math-Italic.ttf
KaTeX_Math-Italic.woff
KaTeX_Math-Italic.woff2
KaTeX_SansSerif-Bold.ttf
KaTeX_SansSerif-Bold.woff
KaTeX_SansSerif-Bold.woff2
KaTeX_SansSerif-Italic.ttf
KaTeX_SansSerif-Italic.woff
KaTeX_SansSerif-Italic.woff2
KaTeX_SansSerif-Regular.ttf
KaTeX_SansSerif-Regular.woff
KaTeX_SansSerif-Regular.woff2
KaTeX_Script-Regular.ttf
KaTeX_Script-Regular.woff
KaTeX_Script-Regular.woff2
KaTeX_Size1-Regular.ttf
KaTeX_Size1-Regular.woff
KaTeX_Size1-Regular.woff2
KaTeX_Size2-Regular.ttf
KaTeX_Size2-Regular.woff
KaTeX_Size2-Regular.woff2
KaTeX_Size3-Regular.ttf
KaTeX_Size3-Regular.woff
KaTeX_Size3-Regular.woff2
KaTeX_Size4-Regular.ttf
KaTeX_Size4-Regular.woff
KaTeX_Size4-Regular.woff2
KaTeX_Typewriter-Regular.ttf
KaTeX_Typewriter-Regular.woff
KaTeX_Typewriter-Regular.woff2
handleReloadUI.js
html_preview_sandbox.html
neon_tab_update.js
operator_animations.js
operator_startpage.html
operator_startpage.js
prevent_new_tab_opening.js
prompt.html
prompt.js
reader_mode.js
operator-scan.glsl
spotify_frame_interceptor.js
vendors.js
voice_capture_worklet.js
manifest.json
messages.json
Icon_Light_Neutral.png
Icon_Light_Neutral.png
7b2eb4d0-108e-4573-b10a-c878f27dd189.tmp
entry.ts-fXgzEoWB.js
entry.ts-loader-dBpbAyqV.js
scraping-method-Dq4mm50p.js
service-worker.ts-fle0M1Xd.js
manifest.json
logo_128.png
logo_128.png
logo_16.png
logo_16.png
logo_32.png
logo_32.png
logo_48.png
logo_48.png
logo_64.png
logo_64.png
messages.json
messages.json
messages.json
messages.json
messages.json
manifest.json
manifest.json
default.dic
5UBH4ME1NXP2QEVPQE3A.temp
5d696d521de238c3.customDestinations-ms
DSP0IEY3Y5SRP3G5LLEI.temp
IW9BXQOXVSZX1DI7F1P4.temp
manifest.json
manifest.json
settings.dat
Bookmarks.bak
Bookmarks00f1100d-adaa-4137-9832-b1fee40d415b.tmp
BookmarksExtras972dd831-ea16-4312-a797-684dea18434a.tmp
temp-index
temp-index
the-real-index
manifest.json
service_worker.js
service-worker-loader.js
main.js
computed_hashes.json
verified_contents.json
messages.json
background.js
content.js.LICENSE.txt
Icon_Light_Active.png
Icon_Light_Available_Red.png
Icon_Light_Available_Yellow.png
Icon_Light_Neutral.png
Icon_Light_Active.png
Icon_Light_Available_Red.png
Icon_Light_Available_Yellow.png
Icon_Light_Neutral.png
index.html
rules.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
computed_hashes.json
_ruleset1
verified_contents.json
background.js.LICENSE.txt
content.js
content_getdify.js
content_getdify.js.LICENSE.txt
Icon_Dark_Neutral.png
Icon_Dark_Neutral.png
popup.js
window.html
window.js
MANIFEST-000001
533eef7f-bba6-436a-97c0-e4f4528a4a66.tmp34399d22-eac2-42e6-a7eb-bb4d5d732eb7.tmp
6387ae65-224c-432b-b958-ab1c480e04e9.tmp42756cf6-a77d-4603-90bc-2a481eb5b27c.tmp
8f028ca1-182c-433a-953a-dae3a9861eb6.tmpf71b2a02-9a38-414e-b93c-b7a6ec3db32f.tmp
c7b73174-93f5-4499-ad44-cdfbd99a3951.tmpa1f2143e-1a76-4030-a853-b89142ea32f6.tmp
d86ca902-5d00-42e2-afb0-4359d8aaf55d.tmp990e2437-86cf-4c95-a44f-40f8360f050a.tmp
e395ff3e-93a1-4544-9762-fe757f407413.tmp9f3bb483-9f0b-4687-a470-f5a2191ad6ab.tmp
Network Persistent State.backup
Network Persistent Stated74d7ce1-6a40-4cca-a06d-d49d8e50a0ca.tmp
Preferences0a03328d-1bf3-4dac-9232-ed643ff94fbc.tmp
Preferences0f93b19c-3cb2-44a5-8d87-a3c9f30d6326.tmp
Preferences19bb15f7-be83-45db-b0e2-2de4a923309e.tmp
Preferences2938fc13-c664-430f-9576-17e9ecc24c85.tmp
Preferencesa1c2297b-debb-4c57-94e3-f44de40af1cd.tmp
Secure Preferences.backup
Secure Preferencesb5872ce7-a2e1-4132-a5ee-ccf748190093.tmp
Secure Preferencesef8cb1b6-52dd-4ab3-b978-68267ad12860.tmp
0ae129c33e7a30bd_0
0ae129c33e7a30bd_1
f3ab1e1292e135fa_0
temp-index
temp-index
temp-index
the-real-index
session_75c9ffa8-f477-407b-9c88-005634604e55.raw
session_75c9ffa8-f477-407b-9c88-005634604e55.raw
session_75c9ffa8-f477-407b-9c88-005634604e55.raw03a7ca09-157f-41e9-9856-d787303cfc8f.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw16fd9d5a-63b3-4648-b50b-ba2cf0607270.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw39968742-6795-4df4-9195-faf470425b57.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw3a035424-9ecb-4a1e-8374-367fff935212.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw3d026c3f-31c4-4ab7-ad5e-b159d4a79b17.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw40e9b696-144e-4daa-9436-0cf7a01369d8.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw412119f6-0e45-4acc-b5ad-20db9757a30a.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw4179fe94-0cf6-4dbf-a57b-cb7c534901e2.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw4468d326-c2dc-4274-9b62-8081f5378e08.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw46072f5c-cb4c-4dc1-a108-c838a91fac00.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw515d04db-d34d-460f-8da5-c0b812dd1dec.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw517e73f1-33a7-4af5-963e-1e4b1a4971bb.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw5e9c7042-d15b-4f2d-bdc3-884152f066b3.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw6387ca13-419e-4cb7-855f-3cf036f6e595.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw66cf0cf4-0cba-4e8d-87c2-bc4869c72d43.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw6d7c8743-e278-44ee-b767-36279198bb37.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw6ff2c939-af7c-414a-af2b-4d60d02f6be8.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw72414c0c-6e9f-416b-9654-9068fd771e2a.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw77c49eb7-1d61-4d6a-8f98-4ae1bff323ff.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw77c8471c-b1b0-4a4c-9ae6-8964e1422d03.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw803b3686-8c77-4088-b80e-8ab5aac6535b.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw80484087-da3a-4941-9120-bf1543530fed.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw83cb7adc-728c-4875-95e5-23940dbea174.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw8bcac0d2-732f-407b-87a0-be88d65fdd73.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw8fac9aa6-cf6a-4dd6-93c4-022a04e999a5.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw908625c2-37b0-43c3-9959-23fee4a792ee.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw928298a6-aef2-437d-9d4c-6fb55e0c8173.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw9bbbc196-a667-4954-8cd5-b908b9d25600.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raw9e6cbc95-bbac-4446-9edd-cab6d54be8b8.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawa3a0a91a-e0a2-4419-a89b-2c8ded2c9c66.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawa9e6def3-6a79-42c7-98e2-088aead8345d.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawaaabe2bd-2f02-4878-b71c-e5363d78123e.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawab4fc207-5f37-490d-a39c-fd8bdc76a90d.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawad0f7e49-7875-45bf-9ad4-0f0a3e9b729b.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawb0771cef-3fca-4001-814c-2b945e0f333e.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawb11e0b09-cd64-492c-847a-9e31eb116fe6.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawb36cd5ba-05af-42b5-b57a-b0d08aa97f63.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawb43e76ee-41bf-4a10-9ada-33795540586c.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawb4b6809a-a101-4cfc-861b-8e44600d4d40.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawb686c138-13c3-470b-82e9-31212785b335.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawb7413417-5b83-46c7-8c77-a1261df8592e.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawbdfbb7a4-a77a-4894-88cb-5f590a690351.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawc567aecc-5af2-4c9d-ab3e-7a1f241a8f44.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawc800b3c2-fd7b-4cd5-92c2-4b826ff5b3b8.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawd39228f7-3202-487b-a86c-16426b99c634.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawd452ac20-acfa-47fd-928b-4a064e8ec945.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawd7e2ba62-954f-40ef-be17-baa6953a92e4.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawd7f1efdd-8237-41a3-96b5-67e070364d15.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawdcce0271-37a1-481e-831a-91313fe62621.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawdde1ccc9-923c-4c07-9614-37b113fcff22.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawe3365265-b8c1-4deb-8f3e-89d406540bc3.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawe44ab39d-38dd-4dc0-9ffe-bddfe60d7aee.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawe613be8d-2a61-4854-9caa-e9be1f2546a6.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawe84167eb-c8bf-40eb-a144-eb68b6c03734.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.raweabda92e-ff89-4860-8201-31bceaa7c8d5.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawf979699b-ee7e-480b-ac56-9d4c8dc66881.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawfc652207-b752-43a5-bda0-99bf1bd86c7c.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawfd007c52-1f10-4733-a204-d8bd9ac1ad43.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawfd32402e-6a2e-43ea-a60f-c29920a57c1c.tmp
session_75c9ffa8-f477-407b-9c88-005634604e55.rawffe2528d-c187-431f-a810-55ed715b2806.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw0166d65b-0943-4932-ab21-47821f31ff5e.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw107a4a10-5369-443a-9b60-29083b1098b1.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw2777386e-7dd9-4da5-b5a8-18df92b63c85.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw4b13c1fe-34c8-4e82-91d3-1f2a710cfe0f.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw4bc435de-b4ce-4600-afc2-de20e663b1c5.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw547d4be1-1155-4469-907c-76606305ecdf.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw87c54c45-3d18-460f-8518-ef6ae8ea8d93.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raw9673fa45-78c4-4804-a06c-aaf71da0dd68.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.rawb89cf9b1-7e76-41ed-9c8f-b57d87a72e08.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.rawe05a3efa-d920-4506-bd9a-40416b66d860.tmp
session_ce2c702d-a70a-49d0-a6be-b62deb1a1a7d.raweb732a2a-3a80-4bfd-95bd-d69268d8159c.tmp
rhs.dat
ssdfp2276.0.1276952089
ssdfp2276.0.12769520898629930a-f5f9-47cf-b5fd-0fd0a8e0fa55.tmp
ssdfp2276.0.12769520898d173e9f-e313-48a1-83cc-3f576b666b8a.tmp
ssdfp2276.0.1276952089b0e5acc1-d6fc-4972-b659-52ee63514595.tmp
ssdfp7504.0.694099078
ssdfp7504.0.69409907806fbdff8-ae25-4abb-a111-8922a010ac6a.tmp
ssdfp7504.0.6940990780b04f35f-5cc7-475b-b3f5-9a060846de18.tmp
ssdfp7504.0.6940990780c44e755-1508-4577-8801-16d4499dadc4.tmp
ssdfp7504.0.69409907816cfcc53-8b2a-4c64-84a3-cc292d64e2c4.tmp
ssdfp7504.0.694099078198a6aaa-c5bb-423d-83f2-19d8b28aa599.tmp
ssdfp7504.0.69409907839b39fcd-337a-49e1-adf0-08716eb5e77d.tmp
ssdfp7504.0.6940990785806da15-684d-4476-8b2d-f7e8bccf30a4.tmp
ssdfp7504.0.6940990786f7b184c-e7f2-4b1a-bdec-7596a08a1ab9.tmp
ssdfp7504.0.694099078714fb548-4b6b-4a07-bf14-61b0bf39235e.tmp
ssdfp7504.0.69409907882ea3379-f59e-4264-a7b1-79c7990acea1.tmp
ssdfp7504.0.69409907885fced45-4842-48e2-b54b-0f4b84b5689e.tmp
ssdfp7504.0.694099078943e8b3b-f4eb-49b1-a99f-4c2b02bc845b.tmp
ssdfp7504.0.694099078955d98b0-3be9-494b-99fe-dcc2275d00c6.tmp
ssdfp7504.0.6940990789ae8684e-8060-4e4d-8439-9db3fa53eab1.tmp
ssdfp7504.0.6940990789e0ec4fd-f5fb-422e-9d3e-fa1371e750e0.tmp
ssdfp7504.0.694099078b39c43ab-8732-436b-b1a2-b8dbf41bfb49.tmp
ssdfp7504.0.694099078b85cbfa8-61d2-4c18-bc27-9ebcc87b20aa.tmp
ssdfp7504.0.694099078b8e153da-d32e-46ec-b2d4-988e2ec144f7.tmp
ssdfp7504.0.694099078bc99ca3d-ee6b-44ff-843b-770576129972.tmp
ssdfp7504.0.694099078d1f69bd4-74a0-4584-93c0-3aae0f904a5d.tmp
ssdfp7504.0.694099078db37244d-869e-4332-bf8b-c8dfb095d871.tmp
ssdfp7504.0.694099078eda87468-c0c9-4653-9f12-f8e45e8f178c.tmp
ssdfp7504.1.1415384797
ssdfp7504.1.14153847971ef07b0f-d306-4d5c-a01e-00c4dddefd78.tmp
ssdfp7504.1.1415384797b23adc30-ad8b-4af9-9217-29b86e3bc2c5.tmp
suggestions_cache.json7913d733-4911-44a6-8132-f881d3f87503.tmp
Local State
Local State97acaf87-6ebf-4c95-b070-b275bccd8c47.tmp
Local State980e31b5-8853-4fc9-b762-243e7cd2ba1c.tmp
Local Stated23224eb-1cad-45c9-a859-59a295920949.tmp
Local Statef15546b3-9bc3-45e4-b7a9-c246944a2b82.tmp
Local Statefb932b46-6012-4261-9a58-eb4736986b9d.tmp
manifest.json
manifest.json
manifest.json
VariationsSafeSeedV2
VariationsSeedV2812aebd5-ce08-45cf-b3b6-f4888ee51146.tmp
manifest.json
assistant_prefs.json
assistant_prefs.json759680fc-d909-4ff9-93dd-272629ad0bec.tmp
clipboard_injection_guard_rules.json
3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657
metadata.json253897f0-3941-4c6d-ad7c-e1602f034416.tmp
metadata.json2da47aed-b090-458f-9d6b-913a4391e22b.tmp
metadata.json62588fb5-7599-470a-9e5a-efdeb1034874.tmp
metadata.json7962ef03-e36a-413c-9386-bfa4a8d82925.tmp
metadata.json96433597-5107-4b91-b57b-71ba2c1fe36c.tmp
metadata.jsonbd06f85c-8df9-4e2a-bbbd-1be890024eb7.tmp
metadata.jsonc89a15fa-0d27-4fcb-84e0-8f21868b66b4.tmp
metadata.jsonebf0ff7a-9af4-4f61-835c-509a0f2dca29.tmp
5ac35d2b-eabf-4ca5-8c47-5377bacf8e5c.tmp
Unconfirmed 747780.crdownload
d3940559-a006-4da4-8bda-c8076d8329dd.tmp
manifest.fingerprint
protocols.json
verified_contents.json
keys.json
manifest.fingerprint
english_wikipedia.txt
female_names.txt
male_names.txt
manifest.fingerprint
model.markov
passwords.txt
ranked_dicts
surnames.txt
test.txt
us_tv_and_film.txt
crs.pb
ct_config.pb
kp_pinslist.pb
manifest.fingerprint
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
manifest.fingerprint
Filtering Rules
Filtering Rules-AA
Filtering Rules-CA
LICENSE
Part-DE
Part-ES
Part-FR
Part-IT
Part-NL
Part-RU
Part-ZH
adblock_snippet.js
manifest.fingerprint
LICENSE
verified_contents.json
widevinecdm.dll
widevinecdm.dll.sig
manifest.fingerprint
Microsoft.CognitiveServices.Speech.core.dll
manifest.fingerprint
verified_contents.json
hyph-af.hyb
hyph-be.hyb
hyph-bg.hyb
hyph-cs.hyb
hyph-cu.hyb
hyph-cy.hyb
hyph-da.hyb
hyph-de-1901.hyb
hyph-de-1996.hyb
hyph-de-ch-1901.hyb
hyph-el.hyb
hyph-en-gb.hyb
hyph-en-us.hyb
hyph-es.hyb
hyph-et.hyb
hyph-eu.hyb
hyph-fr.hyb
hyph-ga.hyb
hyph-gl.hyb
hyph-gu.hyb
hyph-hr.hyb
hyph-hu.hyb
hyph-hy.hyb
hyph-it.hyb
hyph-ka.hyb
hyph-kn.hyb
hyph-la.hyb
hyph-lt.hyb
hyph-lv.hyb
hyph-ml.hyb
hyph-mn-cyrl.hyb
hyph-mul-ethi.hyb
hyph-nl.hyb
hyph-or.hyb
hyph-pa.hyb
hyph-pt.hyb
hyph-ru.hyb
hyph-sk.hyb
hyph-sl.hyb
hyph-sq.hyb
hyph-sv.hyb
hyph-ta.hyb
hyph-te.hyb
hyph-tk.hyb
hyph-uk.hyb
hyph-und-ethi.hyb
manifest.fingerprint
verified_contents.json
preloaded_data.pb
verified_contents.json
safety_tips.pb
verified_contents.json
widevinecdm.dll
widevinecdm.dll.sig
LICENSE
verified_contents.json
crl-set
verified_contents.json
heuristic_regexes.binarypb
verified_contents.json
crs.pb
ct_config.pb
kp_pinslist.pb
mtc_config.pb
opera-one.jpg
persona.ini
opera-one-dark.jpg
persona.ini
memory/1836-1272-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1264-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1265-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1269-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1270-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1263-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1274-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1273-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/1836-1271-0x0000018FC0740000-0x0000018FC0741000-memory.dmp
memory/2348-344-0x00007FFAEC340000-0x00007FFAEC341000-memory.dmp
memory/2980-443-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-454-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-442-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-459-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-458-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-457-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-456-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-455-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-444-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/2980-453-0x00000182A91D0000-0x00000182A91D1000-memory.dmp
memory/4308-226-0x00007FFAEC340000-0x00007FFAEC341000-memory.dmp
memory/4384-550-0x0000020E6A9C0000-0x0000020E6A9D0000-memory.dmp
memory/4384-173-0x0000020E6BE80000-0x0000020E6BF10000-memory.dmp
memory/4384-150-0x0000020E68790000-0x0000020E687D6000-memory.dmp
memory/4384-155-0x0000020E687E0000-0x0000020E687F8000-memory.dmp
memory/4384-194-0x0000020E6BDD0000-0x0000020E6BDDE000-memory.dmp
memory/4384-179-0x0000020E6A9C0000-0x0000020E6A9D0000-memory.dmp
memory/4384-140-0x0000020E66AB0000-0x0000020E66B06000-memory.dmp
memory/4384-147-0x0000020E6AC70000-0x0000020E6B198000-memory.dmp
memory/4384-177-0x0000020E6BE20000-0x0000020E6BE42000-memory.dmp
memory/4384-146-0x0000020E66F40000-0x0000020E66F54000-memory.dmp
memory/4384-148-0x0000020E6A9C0000-0x0000020E6A9D0000-memory.dmp
memory/4384-144-0x0000020E6A600000-0x0000020E6A6AC000-memory.dmp
memory/4384-166-0x0000020E6AA80000-0x0000020E6AB30000-memory.dmp
memory/4384-549-0x0000020E6A9C0000-0x0000020E6A9D0000-memory.dmp
memory/6944-2282-0x00007FFAEBAF0000-0x00007FFAEBAF1000-memory.dmp
memory/6944-2281-0x00007FFAECDF0000-0x00007FFAECDF1000-memory.dmp
memory/7096-6819-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6818-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6817-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6826-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6825-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6828-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6824-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6823-0x000001D666900000-0x000001D666901000-memory.dmp
memory/7096-6827-0x000001D666900000-0x000001D666901000-memory.dmp