| File name: | OperaInstaller (4).exe |
| Full analysis: | https://app.any.run/tasks/8284cb77-3308-4285-b847-e8c4058a53cd |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | June 10, 2025, 07:58:14 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 9476256F46500D7B10360680EC8E473B |
| SHA1: | 2A7379C294A646D5A9B930FAB23E652D68873906 |
| SHA256: | 5255AA5F489C656C6BA3557C47AA26805C7C5B29C8E5E107C87DCDC9B08ACBE8 |
| SSDEEP: | 6144:fVNDuHmByrOPrDsBkfJfWQs/yO0DDDDDDDDDDDgrDDDDDDXfKBS/:dN/BU+rwBkh+QzDDDDDDDDDDDgrDDDDx |
MALICIOUS
GENERIC has been found (auto)
- OperaInstaller (4).exe (PID: 7820)
Steals credentials from Web Browsers
- setup.exe (PID: 6272)
- setup.exe (PID: 5304)
- setup.exe (PID: 5452)
- setup.exe (PID: 5400)
- assistant_installer.exe (PID: 1188)
- assistant_installer.exe (PID: 1240)
- assistant_installer.exe (PID: 6060)
- assistant_installer.exe (PID: 7232)
- installer.exe (PID: 924)
- installer.exe (PID: 8064)
- assistant_installer.exe (PID: 7908)
- assistant_installer.exe (PID: 864)
- opera.exe (PID: 6464)
- opera_crashreporter.exe (PID: 7892)
- opera_crashreporter.exe (PID: 4976)
- opera.exe (PID: 5596)
- opera_crashreporter.exe (PID: 5548)
- opera.exe (PID: 2136)
- opera_crashreporter.exe (PID: 5508)
- browser_assistant.exe (PID: 7260)
- opera.exe (PID: 3032)
- opera_crashreporter.exe (PID: 1764)
- opera.exe (PID: 1120)
- browser_assistant.exe (PID: 6632)
- opera.exe (PID: 7544)
- opera_crashreporter.exe (PID: 7560)
- opera.exe (PID: 7292)
- opera_crashreporter.exe (PID: 7304)
- opera.exe (PID: 6724)
- installer.exe (PID: 7784)
- installer.exe (PID: 780)
- opera_autoupdate.exe (PID: 7888)
- opera_autoupdate.exe (PID: 4572)
- opera_autoupdate.exe (PID: 7224)
- opera_autoupdate.exe (PID: 2088)
Actions looks like stealing of personal data
- setup.exe (PID: 6272)
- opera_crashreporter.exe (PID: 7892)
- opera_crashreporter.exe (PID: 4976)
- opera.exe (PID: 5596)
- opera_crashreporter.exe (PID: 5548)
- opera.exe (PID: 7292)
- browser_assistant.exe (PID: 7260)
- opera.exe (PID: 6724)
- opera_autoupdate.exe (PID: 7224)
- opera_autoupdate.exe (PID: 2088)
Changes the autorun value in the registry
- assistant_installer.exe (PID: 6060)
- opera.exe (PID: 5596)
- opera.exe (PID: 7292)
SUSPICIOUS
Reads security settings of Internet Explorer
- OperaInstaller (4).exe (PID: 7820)
- setup.exe (PID: 6272)
- installer.exe (PID: 8064)
- browser_assistant.exe (PID: 7260)
Executable content was dropped or overwritten
- OperaInstaller (4).exe (PID: 7820)
- OpInst.exe (PID: 1672)
- setup.exe (PID: 6272)
- setup.exe (PID: 5304)
- setup.exe (PID: 5236)
- setup.exe (PID: 5452)
- Assistant_118.0.5461.41_Setup.exe_sfx.exe (PID: 2244)
- setup.exe (PID: 5400)
- installer.exe (PID: 8064)
- assistant_installer.exe (PID: 6060)
- installer.exe (PID: 924)
- installer.exe (PID: 780)
- installer.exe (PID: 7784)
- opera.exe (PID: 8740)
- opera.exe (PID: 7280)
- opera_autoupdate.exe (PID: 4572)
- installer.exe (PID: 6940)
Starts itself from another location
- setup.exe (PID: 6272)
Application launched itself
- setup.exe (PID: 6272)
- setup.exe (PID: 5452)
- installer.exe (PID: 8064)
- assistant_installer.exe (PID: 1240)
- assistant_installer.exe (PID: 6060)
- assistant_installer.exe (PID: 7908)
- browser_assistant.exe (PID: 7260)
- opera.exe (PID: 5596)
- opera.exe (PID: 7292)
- installer.exe (PID: 780)
- opera_autoupdate.exe (PID: 2088)
- opera_autoupdate.exe (PID: 4572)
Process drops legitimate windows executable
- Assistant_118.0.5461.41_Setup.exe_sfx.exe (PID: 2244)
- assistant_installer.exe (PID: 6060)
Creates a software uninstall entry
- installer.exe (PID: 8064)
Searches for installed software
- installer.exe (PID: 8064)
- browser_assistant.exe (PID: 7260)
Reads the date of Windows installation
- installer.exe (PID: 8064)
- opera.exe (PID: 7292)
There is functionality for taking screenshot (YARA)
- setup.exe (PID: 6272)
Reads Mozilla Firefox installation path
- opera.exe (PID: 7292)
The process executes via Task Scheduler
- opera_autoupdate.exe (PID: 4572)
The process checks if it is being run in the virtual environment
- opera.exe (PID: 7292)
Found regular expressions for crypto-addresses (YARA)
- opera.exe (PID: 924)
INFO
Checks proxy server information
- OperaInstaller (4).exe (PID: 7820)
- setup.exe (PID: 6272)
- opera.exe (PID: 5596)
- opera.exe (PID: 7292)
- browser_assistant.exe (PID: 7260)
Checks supported languages
- OperaInstaller (4).exe (PID: 7820)
- OpInst.exe (PID: 1672)
- setup.exe (PID: 6272)
- setup.exe (PID: 5304)
- setup.exe (PID: 5236)
- setup.exe (PID: 5400)
- Assistant_118.0.5461.41_Setup.exe_sfx.exe (PID: 2244)
- setup.exe (PID: 5452)
- assistant_installer.exe (PID: 1188)
- installer.exe (PID: 8064)
- installer.exe (PID: 924)
- assistant_installer.exe (PID: 1240)
- assistant_installer.exe (PID: 7232)
- assistant_installer.exe (PID: 7908)
- assistant_installer.exe (PID: 6060)
- assistant_installer.exe (PID: 864)
- opera.exe (PID: 5596)
- browser_assistant.exe (PID: 7260)
- opera.exe (PID: 6464)
- opera_crashreporter.exe (PID: 7892)
- opera_crashreporter.exe (PID: 4976)
- browser_assistant.exe (PID: 6632)
- opera.exe (PID: 2136)
- opera_crashreporter.exe (PID: 5548)
- opera.exe (PID: 3032)
- opera.exe (PID: 7540)
- opera.exe (PID: 7528)
- opera.exe (PID: 2152)
- opera.exe (PID: 1120)
- opera_crashreporter.exe (PID: 1764)
- opera.exe (PID: 7292)
- opera.exe (PID: 7544)
- opera_crashreporter.exe (PID: 7560)
- opera_crashreporter.exe (PID: 7304)
- opera_crashreporter.exe (PID: 5508)
- opera.exe (PID: 6724)
- opera.exe (PID: 240)
- opera.exe (PID: 5308)
- opera.exe (PID: 6480)
- opera.exe (PID: 7196)
- opera.exe (PID: 7592)
- opera.exe (PID: 2392)
- opera.exe (PID: 5416)
- opera.exe (PID: 7364)
- opera.exe (PID: 5588)
- opera_gx_splash.exe (PID: 7184)
- opera.exe (PID: 3180)
- opera.exe (PID: 8024)
- opera.exe (PID: 924)
- opera.exe (PID: 5332)
- opera.exe (PID: 7284)
- opera.exe (PID: 1348)
- opera.exe (PID: 7580)
- opera.exe (PID: 6980)
- opera.exe (PID: 5064)
- opera.exe (PID: 7616)
- opera.exe (PID: 3124)
- opera.exe (PID: 2432)
- opera.exe (PID: 8112)
- opera.exe (PID: 856)
- opera.exe (PID: 5776)
- opera.exe (PID: 7840)
- opera.exe (PID: 8152)
- opera.exe (PID: 7348)
- opera.exe (PID: 7504)
- opera.exe (PID: 4172)
- opera.exe (PID: 5608)
- opera.exe (PID: 7244)
- opera.exe (PID: 1052)
- installer.exe (PID: 780)
- opera.exe (PID: 6840)
- opera.exe (PID: 4988)
- opera.exe (PID: 8024)
- opera.exe (PID: 7384)
- installer.exe (PID: 7784)
- opera_autoupdate.exe (PID: 4572)
- opera_autoupdate.exe (PID: 2088)
- opera.exe (PID: 7544)
- opera_autoupdate.exe (PID: 7888)
- opera.exe (PID: 4692)
- opera.exe (PID: 6992)
- opera.exe (PID: 2908)
- opera_autoupdate.exe (PID: 7224)
- opera.exe (PID: 8220)
- opera.exe (PID: 8212)
- opera.exe (PID: 8228)
- opera.exe (PID: 8308)
- opera.exe (PID: 8348)
- opera.exe (PID: 8424)
- opera.exe (PID: 8564)
- opera.exe (PID: 8464)
- opera.exe (PID: 8472)
- opera.exe (PID: 8604)
- opera.exe (PID: 8644)
- opera.exe (PID: 5260)
Reads the computer name
- OperaInstaller (4).exe (PID: 7820)
- setup.exe (PID: 6272)
- setup.exe (PID: 5452)
- assistant_installer.exe (PID: 1240)
- installer.exe (PID: 8064)
- assistant_installer.exe (PID: 6060)
- assistant_installer.exe (PID: 7908)
- opera.exe (PID: 6464)
- opera.exe (PID: 5596)
- browser_assistant.exe (PID: 7260)
- opera.exe (PID: 2136)
- opera.exe (PID: 7540)
- opera.exe (PID: 7528)
- opera.exe (PID: 1120)
- opera.exe (PID: 7544)
- opera.exe (PID: 7292)
- opera.exe (PID: 3032)
- opera.exe (PID: 240)
- opera_gx_splash.exe (PID: 7184)
- opera.exe (PID: 6724)
- opera.exe (PID: 7384)
- installer.exe (PID: 780)
- opera_autoupdate.exe (PID: 4572)
- opera_autoupdate.exe (PID: 2088)
Reads the machine GUID from the registry
- OperaInstaller (4).exe (PID: 7820)
- setup.exe (PID: 6272)
- installer.exe (PID: 8064)
- opera.exe (PID: 5596)
- opera.exe (PID: 7292)
- browser_assistant.exe (PID: 7260)
- opera_autoupdate.exe (PID: 4572)
- opera_autoupdate.exe (PID: 2088)
- opera_autoupdate.exe (PID: 7888)
- opera_autoupdate.exe (PID: 7224)
Creates files or folders in the user directory
- OperaInstaller (4).exe (PID: 7820)
- setup.exe (PID: 5304)
- setup.exe (PID: 6272)
- setup.exe (PID: 5452)
- assistant_installer.exe (PID: 6060)
- installer.exe (PID: 8064)
- opera.exe (PID: 5596)
- browser_assistant.exe (PID: 7260)
- opera.exe (PID: 7292)
- opera.exe (PID: 6724)
- opera_autoupdate.exe (PID: 7224)
- opera_autoupdate.exe (PID: 2088)
Reads the software policy settings
- OperaInstaller (4).exe (PID: 7820)
- setup.exe (PID: 6272)
- installer.exe (PID: 8064)
- browser_assistant.exe (PID: 7260)
Process checks computer location settings
- OperaInstaller (4).exe (PID: 7820)
- opera.exe (PID: 5596)
- opera.exe (PID: 7292)
- opera.exe (PID: 7364)
- opera.exe (PID: 8024)
- opera.exe (PID: 5332)
- opera.exe (PID: 924)
- opera.exe (PID: 1348)
- opera.exe (PID: 7284)
- opera.exe (PID: 5608)
- opera.exe (PID: 1052)
- opera.exe (PID: 7244)
- opera.exe (PID: 4988)
- opera.exe (PID: 4172)
- opera.exe (PID: 8464)
- opera.exe (PID: 8228)
- opera.exe (PID: 8348)
Create files in a temporary directory
- OperaInstaller (4).exe (PID: 7820)
- OpInst.exe (PID: 1672)
- setup.exe (PID: 6272)
- setup.exe (PID: 5304)
- setup.exe (PID: 5236)
- setup.exe (PID: 5452)
- setup.exe (PID: 5400)
- Assistant_118.0.5461.41_Setup.exe_sfx.exe (PID: 2244)
- installer.exe (PID: 8064)
- installer.exe (PID: 924)
- opera.exe (PID: 5596)
- opera.exe (PID: 7292)
- installer.exe (PID: 780)
- installer.exe (PID: 7784)
The sample compiled with english language support
- OpInst.exe (PID: 1672)
- setup.exe (PID: 6272)
- setup.exe (PID: 5304)
- setup.exe (PID: 5236)
- setup.exe (PID: 5452)
- setup.exe (PID: 5400)
- installer.exe (PID: 924)
- Assistant_118.0.5461.41_Setup.exe_sfx.exe (PID: 2244)
- installer.exe (PID: 8064)
- assistant_installer.exe (PID: 6060)
- installer.exe (PID: 780)
- installer.exe (PID: 7784)
- opera.exe (PID: 8740)
- opera.exe (PID: 7280)
- opera_autoupdate.exe (PID: 4572)
- installer.exe (PID: 6940)
Manual execution by a user
- assistant_installer.exe (PID: 7908)
Launching a file from a Registry key
- assistant_installer.exe (PID: 6060)
- opera.exe (PID: 5596)
- opera.exe (PID: 7292)
OPERA mutex has been found
- opera.exe (PID: 7292)
- browser_assistant.exe (PID: 7260)
- opera.exe (PID: 5596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:03:11 00:41:00+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.41 |
| CodeSize: | 87040 |
| InitializedDataSize: | 74240 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x4757 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
272
Monitored processes
140
Malicious processes
20
Suspicious processes
18
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 240 | "C:\Users\admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-keywords-monetization=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amazon-bookmarks-tags-update=on --with-feature:amp-requests-stats=on --with-feature:aria-in-tab-view=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:keywords-from-backend=off --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:suggestion-redirect-handler=on --with-feature:installer-experiment-test=off --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2040,i,6675210092666979578,1675499920879205199,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu,UpdatableKeyPins --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2 | C:\Users\admin\AppData\Local\Programs\Opera\opera.exe | — | opera.exe | |||||||||||
User: admin Company: Opera Software Integrity Level: LOW Description: Opera Internet Browser Version: 119.0.5497.70 Modules
| |||||||||||||||
| 780 | "C:\Users\admin\AppData\Local\Programs\Opera\119.0.5497.70\installer.exe" --fix-taskbar-pins | C:\Users\admin\AppData\Local\Programs\Opera\119.0.5497.70\installer.exe | opera.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Installer Exit code: 0 Version: 119.0.5497.70 Modules
| |||||||||||||||
| 856 | "C:\Users\admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-pre-read-main-dll --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-keywords-monetization=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amazon-bookmarks-tags-update=on --with-feature:amp-requests-stats=on --with-feature:aria-in-tab-view=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:keywords-from-backend=off --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:suggestion-redirect-handler=on --with-feature:installer-experiment-test=off --field-trial-handle=2040,i,6675210092666979578,1675499920879205199,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu,UpdatableKeyPins --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:8 | C:\Users\admin\AppData\Local\Programs\Opera\opera.exe | — | opera.exe | |||||||||||
User: admin Company: Opera Software Integrity Level: LOW Description: Opera Internet Browser Exit code: 0 Version: 119.0.5497.70 Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=118.0.5461.41 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x59103c,0x591048,0x591054 | C:\Users\admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe | assistant_installer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Browser Assistant Installer Exit code: 0 Version: 118.0.5461.41 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Programs\Opera\119.0.5497.70\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=119.0.5497.70 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ffc88728f08,0x7ffc88728f14,0x7ffc88728f20 | C:\Users\admin\AppData\Local\Programs\Opera\119.0.5497.70\installer.exe | installer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Installer Exit code: 0 Version: 119.0.5497.70 Modules
| |||||||||||||||
| 924 | "C:\Users\admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-keywords-monetization=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amazon-bookmarks-tags-update=on --with-feature:amp-requests-stats=on --with-feature:aria-in-tab-view=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:keywords-from-backend=off --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:suggestion-redirect-handler=on --with-feature:installer-experiment-test=off --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=2040,i,6675210092666979578,1675499920879205199,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu,UpdatableKeyPins --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1 | C:\Users\admin\AppData\Local\Programs\Opera\opera.exe | — | opera.exe | |||||||||||
User: admin Company: Opera Software Integrity Level: LOW Description: Opera Internet Browser Version: 119.0.5497.70 Modules
| |||||||||||||||
| 1052 | "C:\Users\admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-dropdown-keyword-ads=on --with-feature:address-bar-keywords-monetization=on --with-feature:ai-tab-management=on --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amazon-bookmarks-tags-update=on --with-feature:amp-requests-stats=on --with-feature:aria-in-tab-view=on --with-feature:bluesky-in-sidebar=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:discord-in-sidebar=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:hide-navigations-from-extensions=on --with-feature:keywords-from-backend=off --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:slack-in-sidebar=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner=on --with-feature:suggestion-redirect-handler=on --with-feature:installer-experiment-test=off --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=2040,i,6675210092666979578,1675499920879205199,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu,UpdatableKeyPins --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:1 | C:\Users\admin\AppData\Local\Programs\Opera\opera.exe | — | opera.exe | |||||||||||
User: admin Company: Opera Software Integrity Level: LOW Description: Opera Internet Browser Exit code: 0 Version: 119.0.5497.70 Modules
| |||||||||||||||
| 1120 | "C:\Users\admin\AppData\Local\Programs\Opera\opera.exe" --stream | C:\Users\admin\AppData\Local\Programs\Opera\opera.exe | browser_assistant.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 119.0.5497.70 Modules
| |||||||||||||||
| 1176 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1188 | "C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202506100758211\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=118.0.5461.41 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x5f103c,0x5f1048,0x5f1054 | C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202506100758211\assistant\assistant_installer.exe | assistant_installer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Browser Assistant Installer Exit code: 0 Version: 118.0.5461.41 Modules
| |||||||||||||||
Total events
23 154
Read events
21 688
Write events
1 445
Delete events
21
Modification events
| (PID) Process: | (7820) OperaInstaller (4).exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7820) OperaInstaller (4).exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7820) OperaInstaller (4).exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6272) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6272) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6272) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5452) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Opera Software |
| Operation: | write | Name: | Last Stable Install Path |
Value: C:\Users\admin\AppData\Local\Programs\Opera\ | |||
| (PID) Process: | (8064) installer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Opera Software |
| Operation: | write | Name: | Last Stable Install Path |
Value: C:\Users\admin\AppData\Local\Programs\Opera\ | |||
| (PID) Process: | (8064) installer.exe | Key: | HKEY_CLASSES_ROOT\OperaStable |
| Operation: | write | Name: | FriendlyTypeName |
Value: Opera Web Document | |||
| (PID) Process: | (8064) installer.exe | Key: | HKEY_CLASSES_ROOT\OperaStable |
| Operation: | write | Name: | URL Protocol |
Value: | |||
Executable files
31
Suspicious files
1 081
Text files
975
Unknown types
279
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7820 | OperaInstaller (4).exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 | binary | |
MD5:ECB6BA70918F3F05151B352D62CB05F8 | SHA256:CB08A025A4CC2A8A1DF950710A61A9D2A373FD8C11D324D9B3878A446003F139 | |||
| 7820 | OperaInstaller (4).exe | C:\Users\admin\AppData\Local\Temp\OpInst.exe | executable | |
MD5:584FA4A182EA539629DDA90F0F4027AD | SHA256:CF20B6F70DF4B671997DDAD71638B23C6C9B3C9E379D0AA1CC69D580A97A3D62 | |||
| 6272 | setup.exe | C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe | executable | |
MD5:18E583AB38762F73407220EB0E762FBF | SHA256:DCA1BD1CC4E34995ECCA53634624731B4D73CCAB83778C4E5787EDCDE51DCDDA | |||
| 7820 | OperaInstaller (4).exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 | der | |
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5 | SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F | |||
| 6272 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Opera_119.0.5497.70_Autoupdate_x64[1].exe | — | |
MD5:— | SHA256:— | |||
| 6272 | setup.exe | C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202506100758211\opera_package | — | |
MD5:— | SHA256:— | |||
| 7820 | OperaInstaller (4).exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 | der | |
MD5:75A3F37AA44877137BDFEDAE96E27E80 | SHA256:34BF36865EB336F9083AB5BF732DB33D493C87AE8A2F8FF28DCF82601842F8C7 | |||
| 7820 | OperaInstaller (4).exe | C:\Users\admin\AppData\Local\Temp\bg.png | image | |
MD5:21EB6B8232802F32B6483EEDB96677BB | SHA256:1464A14A35131D5BD81B618A169401EBA231DAF63A78B18BE3C431EA514ED122 | |||
| 7820 | OperaInstaller (4).exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | binary | |
MD5:A9202E88EA9F521999B579134E189BC5 | SHA256:D7809BF1B221BBF5E73AB30FE768D5381699A501C5CFF1DB208A5FC481DE1636 | |||
| 7820 | OperaInstaller (4).exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 | binary | |
MD5:5DC5F7A61F6D406FD34E57EF38C722CE | SHA256:757B91007FD81F906E6A095992D618CF83F18030C1E55D2C73F8994A8EEBB3D7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
215
DNS requests
216
Threats
148
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.166:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
7820 | OperaInstaller (4).exe | GET | 200 | 142.250.185.67:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
7820 | OperaInstaller (4).exe | GET | 200 | 142.250.185.67:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
7820 | OperaInstaller (4).exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | unknown | — | — | whitelisted |
6272 | setup.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEA17ZgsSl63KHstWnAbUez0%3D | unknown | — | — | whitelisted |
6272 | setup.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D | unknown | — | — | whitelisted |
6272 | setup.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D | unknown | — | — | whitelisted |
6272 | setup.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D | unknown | — | — | whitelisted |
6272 | setup.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA1wc1%2BAcjBp41uP4vSkywg%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6544 | svchost.exe | 20.190.160.3:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
5496 | MoUsoCoreWorker.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
7820 | OperaInstaller (4).exe | 172.67.69.160:443 | opera-download.work.ink | CLOUDFLARENET | US | suspicious |
7820 | OperaInstaller (4).exe | 142.250.185.67:80 | c.pki.goog | GOOGLE | US | whitelisted |
7820 | OperaInstaller (4).exe | 104.26.10.119:443 | opera-download.work.ink | CLOUDFLARENET | US | suspicious |
7820 | OperaInstaller (4).exe | 185.26.182.111:443 | net.geo.opera.com | Opera Software AS | — | whitelisted |
7820 | OperaInstaller (4).exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
opera-download.work.ink |
| unknown |
c.pki.goog |
| whitelisted |
work.ink |
| unknown |
net.geo.opera.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
autoupdate.opera.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6724 | opera.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
6724 | opera.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
6724 | opera.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
6724 | opera.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
6724 | opera.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
6724 | opera.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
6724 | opera.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
6724 | opera.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
6724 | opera.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
6724 | opera.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |