File name:

OperaSetup.exe

Full analysis: https://app.any.run/tasks/38196ff1-7c53-48f4-b5cb-a74858cb44a1
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 31, 2026, 10:35:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

01DD981EC6F4B0318EEB76B42747FC68

SHA1:

122569C952C85F46BCC674D67262AE7228402BE7

SHA256:

66F0E1FEFB307B3D61EA57248DA71BAA1397DEE7943019A125050AAF962D04B9

SSDEEP:

98304:owyWSeMgtMpAtV6JU81xO2DykGqXYpvEYKFyc7M2cxzr6qLqd1HRB/gBjGpg8BwZ:oVEMVVXc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup.exe (PID: 1612)

    • Steals credentials from Web Browsers

      • setup.exe (PID: 1612)
      • setup.exe (PID: 4700)
      • setup.exe (PID: 4220)
      • setup.exe (PID: 2756)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • OperaSetup.exe (PID: 4300)
      • setup.exe (PID: 4700)
      • setup.exe (PID: 1612)
      • setup.exe (PID: 4368)
      • setup.exe (PID: 2756)
      • setup.exe (PID: 4220)

    • Application launched itself

      • setup.exe (PID: 1612)
      • setup.exe (PID: 2756)

    • Starts itself from another location

      • setup.exe (PID: 1612)

  • INFO

    • Create files in a temporary directory

      • OperaSetup.exe (PID: 4300)
      • setup.exe (PID: 1612)
      • setup.exe (PID: 4700)
      • setup.exe (PID: 4368)
      • setup.exe (PID: 2756)
      • setup.exe (PID: 4220)

    • Checks supported languages

      • OperaSetup.exe (PID: 4300)
      • setup.exe (PID: 1612)
      • setup.exe (PID: 4700)
      • setup.exe (PID: 4368)
      • setup.exe (PID: 2756)
      • setup.exe (PID: 4220)

    • The sample compiled with english language support

      • OperaSetup.exe (PID: 4300)
      • setup.exe (PID: 1612)
      • setup.exe (PID: 4700)
      • setup.exe (PID: 4368)
      • setup.exe (PID: 2756)
      • setup.exe (PID: 4220)

    • Reads the computer name

      • setup.exe (PID: 1612)
      • setup.exe (PID: 2756)

    • Creates files or folders in the user directory

      • setup.exe (PID: 4700)
      • setup.exe (PID: 1612)

    • Checks proxy server information

      • setup.exe (PID: 1612)
      • slui.exe (PID: 2432)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 1612)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 1612)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 1612)
      • setup.exe (PID: 4700)
      • setup.exe (PID: 4220)
      • setup.exe (PID: 2756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:12 14:58:14+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 238080
InitializedDataSize: 113152
UninitializedDataSize: -
EntryPoint: 0x213c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 126.0.5750.59
ProductVersionNumber: 126.0.5750.59
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 126.0.5750.59
ProductVersion: 126.0.5750.59
FileDescription: Opera installer SFX
CompanyName:
LegalCopyright: Opera Software 2026
Productname: Opera installer
Stream: Stable
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
8
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start operasetup.exe setup.exe setup.exe setup.exe slui.exe setup.exe setup.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1612C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe --server-tracking-blob=ZDc5ODVlMDk5YTA1ZDBiY2Y0YTNhY2JjOTQxOTlmZmU2NjE5MmIyMWY2ZTBhZWExMTBlMWQ5N2UwMDZkMjVmOTp7ImNvdW50cnkiOiJGUiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYSIsInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP3V0bV9zb3VyY2U9cGVycGxleGl0eS5haSZ1dG1fbWVkaXVtPXJvYyZ1dG1fY2FtcGFpZ249JTI4bm9uZSUyOSZ1dG1fY29udGVudD0lMkYmaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5wZXJwbGV4aXR5LmFpJTJGJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGJmRsX3Rva2VuPTc0NTk4ODM1IiwidGltZXN0YW1wIjoiMTc2OTg1NTcwOC4zNTM2IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0My4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiKG5vbmUpIiwiY29udGVudCI6Ii8iLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS8iLCJtZWRpdW0iOiJyb2MiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoicGVycGxleGl0eS5haSJ9LCJ1dWlkIjoiYjczNmEwM2UtNTk3MS00MWZiLTg4OWMtZmQ0OGIzNDc2NzljIn0=C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe
OperaSetup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Installer
Version:
126.0.5750.59
Modules
Images
c:\users\admin\appdata\local\temp\7zscc03034e\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2432C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2756"C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1612 --package-dir-prefix="C:\Users\admin\AppData\Local\Temp\.opera\d2798ea4-de5f-4942-a937-dde60c6c210d Opera Installer Temp\opera_package_20260131053531" --session-guid=75d1c09e-ab28-4853-bf3c-5abb7e2942bb --server-tracking-blob=NDRjODAxYTdkMzdlNjhhZTRhYWQ4N2I3OTA5OGQ2NTU1NmQzZGU1YjEwYWQ2NzFlMjZhNzk3MmRiNjNiNWJhYjp7ImNvdW50cnkiOiJGUiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhIn0sInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP3V0bV9zb3VyY2U9cGVycGxleGl0eS5haSZ1dG1fbWVkaXVtPXJvYyZ1dG1fY2FtcGFpZ249JTI4bm9uZSUyOSZ1dG1fY29udGVudD0lMkYmaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5wZXJwbGV4aXR5LmFpJTJGJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGJmRsX3Rva2VuPTc0NTk4ODM1Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzY5ODU1NzA4LjM1MzYiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTQzLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiIobm9uZSkiLCJjb250ZW50IjoiLyIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6InJvYyIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiJwZXJwbGV4aXR5LmFpIn0sInV1aWQiOiJiNzM2YTAzZS01OTcxLTQxZmItODg5Yy1mZDQ4YjM0NzY3OWMifQ== --desktopshortcut=1 --wait-for-package --initial-proc-handle=FC09000000000000C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Installer
Version:
126.0.5750.59
Modules
Images
c:\users\admin\appdata\local\temp\7zscc03034e\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4220C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=126.0.5750.59 --initial-client-data=0x2a8,0x2ac,0x2b0,0x270,0x2b4,0x7ffd711cc4c8,0x7ffd711cc4d4,0x7ffd711cc4e0C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Installer
Version:
126.0.5750.59
Modules
Images
c:\users\admin\appdata\local\temp\7zscc03034e\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4300"C:\Users\admin\Desktop\OperaSetup.exe" C:\Users\admin\Desktop\OperaSetup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Opera installer SFX
Version:
126.0.5750.59
Modules
Images
c:\users\admin\desktop\operasetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4368"C:\Users\admin\AppData\Local\Temp\.opera\d2798ea4-de5f-4942-a937-dde60c6c210d Opera Installer Temp\setup.exe" --versionC:\Users\admin\AppData\Local\Temp\.opera\d2798ea4-de5f-4942-a937-dde60c6c210d Opera Installer Temp\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Installer
Exit code:
0
Version:
126.0.5750.59
Modules
Images
c:\users\admin\appdata\local\temp\.opera\d2798ea4-de5f-4942-a937-dde60c6c210d opera installer temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4700C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=126.0.5750.59 --initial-client-data=0x298,0x29c,0x2a0,0x25c,0x2a4,0x7ffd6f3ac4c8,0x7ffd6f3ac4d4,0x7ffd6f3ac4e0C:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Installer
Version:
126.0.5750.59
Modules
Images
c:\users\admin\appdata\local\temp\7zscc03034e\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
7 166
Read events
7 162
Write events
4
Delete events
0

Modification events

(PID) Process:(1612) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1612) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1612) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2756) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera Software
Operation:writeName:Last Stable Install Path
Value:
C:\Users\admin\AppData\Local\Programs\Opera\
Executable files
7
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4220setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2601311036229344220.dllexecutable
MD5:F730196AF0508D1220FB1D8D4646715C
SHA256:2C299AB64D4F1EFBA2B7AD896A9CE37B289D3CEBFB6338E1BEB037AB1DCF5614
1612setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2601311035309961612.dllexecutable
MD5:F730196AF0508D1220FB1D8D4646715C
SHA256:2C299AB64D4F1EFBA2B7AD896A9CE37B289D3CEBFB6338E1BEB037AB1DCF5614
4700setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2601311035311214700.dllexecutable
MD5:F730196AF0508D1220FB1D8D4646715C
SHA256:2C299AB64D4F1EFBA2B7AD896A9CE37B289D3CEBFB6338E1BEB037AB1DCF5614
4300OperaSetup.exeC:\Users\admin\AppData\Local\Temp\7zSCC03034E\setup.exeexecutable
MD5:B65B1B54D7B3E9C6E1CB9C8D7C5E03A3
SHA256:172BCE23A333CF20B0C75199B99DB12D9063A0FCEC8393BF80146697046F0438
2756setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2601311036228242756.dllexecutable
MD5:F730196AF0508D1220FB1D8D4646715C
SHA256:2C299AB64D4F1EFBA2B7AD896A9CE37B289D3CEBFB6338E1BEB037AB1DCF5614
1612setup.exeC:\Users\admin\AppData\Local\Temp\.opera\d2798ea4-de5f-4942-a937-dde60c6c210d Opera Installer Temp\setup.exeexecutable
MD5:B65B1B54D7B3E9C6E1CB9C8D7C5E03A3
SHA256:172BCE23A333CF20B0C75199B99DB12D9063A0FCEC8393BF80146697046F0438
1612setup.exeC:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datbinary
MD5:6428CAB4AA38C644DD2BE19B2A101B95
SHA256:710FEAE1EC14D2D6669DDFC09511CA717533A6D4D4871A79A9D8AD9F9E885FCF
1612setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\features[1].jsontext
MD5:04FC6A764A19928D7DE1523C47AFD7D0
SHA256:1DCEEF889E0ED59A5A465617A58D73ABD25B55F267F4F86D38FC1D3235055391
4368setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2601311035312784368.dllexecutable
MD5:F730196AF0508D1220FB1D8D4646715C
SHA256:2C299AB64D4F1EFBA2B7AD896A9CE37B289D3CEBFB6338E1BEB037AB1DCF5614
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
40
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1612
setup.exe
GET
404
104.18.25.17:443
https://api.config.opr.gg/v0/config?utm_campaign=(none)&utm_medium=roc&utm_source=perplexity.ai&product=&channel=Stable&client=netinstaller&edition=
unknown
—
—
unknown
1612
setup.exe
GET
302
185.26.182.117:443
https://download.opera.com/download/get/?id=75528&autoupdate=1&ni=1&stream=stable&utm_campaign=(none)&utm_content=/&utm_lastpage=opera.com/&utm_medium=roc&utm_site=opera_com&utm_source=perplexity.ai&niuid=b736a03e-5971-41fb-889c-fd48b347679c
unknown
—
—
unknown
1612
setup.exe
GET
—
104.18.10.89:443
https://download5.operacdn.com/ftp/pub/opera/desktop/126.0.5750.59/win/Opera_126.0.5750.59_Autoupdate_x64.exe
unknown
—
—
unknown
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2600
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
185.26.182.123:443
https://autoupdate.opera.com/v5/netinstaller/opera/Stable/windows/x64
unknown
text
1.22 Kb
unknown
1612
setup.exe
GET
302
185.26.182.117:443
https://download.opera.com/download/get/?id=75528&autoupdate=1&ni=1&stream=stable&utm_campaign=(none)&utm_content=/&utm_lastpage=opera.com/&utm_medium=roc&utm_site=opera_com&utm_source=perplexity.ai&niuid=b736a03e-5971-41fb-889c-fd48b347679c
unknown
—
—
unknown
—
—
GET
200
185.26.182.123:443
https://autoupdate.opera.com/me/
unknown
text
46 b
unknown
1612
setup.exe
GET
—
104.18.10.89:443
https://download5.operacdn.com/ftp/pub/opera/desktop/126.0.5750.59/win/Opera_126.0.5750.59_Autoupdate_x64.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.241.201:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2600
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2600
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1612
setup.exe
82.145.217.121:443
desktop-netinstaller-sub.osp.opera.software
NO-OPERA
NO
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.16.241.201
  • 2.16.241.205
  • 2.16.241.218
whitelisted
google.com
  • 142.251.141.142
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
autoupdate.opera.com
  • 185.26.182.124
  • 185.26.182.123
whitelisted
desktop-netinstaller-sub.osp.opera.software
  • 82.145.217.121
whitelisted
features.opera-api2.com
  • 82.145.216.58
  • 82.145.216.15
  • 82.145.216.59
  • 82.145.216.16
malicious
api.config.opr.gg
  • 104.18.25.17
  • 104.18.24.17
whitelisted
download.opera.com
  • 185.26.182.117
  • 185.26.182.122
whitelisted
download5.operacdn.com
  • 104.18.10.89
  • 104.18.11.89
malicious

Threats

No threats detected
Process
Message
setup.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable directory exists )
setup.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OperaSetup.exe