URL:

https://www.mediafire.com/file/00gqhnvmrzi62jm/mame+plus+++6000+roms+++extras+deluxe+-+byrafailo-f1.torrent/file?dkey=ciisul49w21&r=1354

Full analysis: https://app.any.run/tasks/20ee27f4-99f3-4783-b2c1-1774470bdfa6
Verdict: Malicious activity
Analysis date: May 18, 2025, 15:33:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
opera
tool
Indicators:
MD5:

EE48F10F30F570B5D4C2A7C3384B59EF

SHA1:

046E9EA453979DF4BCA3E06C0B61EB176BC54F78

SHA256:

77F212F212409A5524FF2ACA0EE7B87CC91F3D15F1151A65ED7A798AD21639ED

SSDEEP:

3:N8DSLw3eGUoVoU6X+GB4DOh4RPux9vE3NlKcNcr5fcSXaX5WEn:2OLw3eGxJ3GBUVkE3vtcrqSsIE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • opera.exe (PID: 2136)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • OperaGXSetup.exe (PID: 8808)
      • setup.exe (PID: 1348)
      • setup.exe (PID: 6736)
      • setup.exe (PID: 9212)
      • setup.exe (PID: 9192)
      • setup.exe (PID: 8380)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4200)
      • installer.exe (PID: 6652)
      • installer.exe (PID: 3024)
      • installer.exe (PID: 9648)
      • installer.exe (PID: 10676)
      • opera_autoupdate.exe (PID: 5956)
      • installer.exe (PID: 11184)
      • opera.exe (PID: 10620)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6736)
      • installer.exe (PID: 6652)

    • Application launched itself

      • setup.exe (PID: 6736)
      • setup.exe (PID: 9192)
      • assistant_installer.exe (PID: 2908)
      • installer.exe (PID: 6652)
      • opera.exe (PID: 2136)
      • installer.exe (PID: 9648)
      • opera_autoupdate.exe (PID: 10436)
      • opera_autoupdate.exe (PID: 5956)

    • Starts itself from another location

      • setup.exe (PID: 6736)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 6736)
      • setup.exe (PID: 1348)
      • setup.exe (PID: 9192)
      • setup.exe (PID: 8380)

    • Creates a software uninstall entry

      • installer.exe (PID: 6652)

    • Searches for installed software

      • installer.exe (PID: 6652)

    • Reads the date of Windows installation

      • installer.exe (PID: 6652)

    • The process executes via Task Scheduler

      • opera_autoupdate.exe (PID: 5956)

  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 8492)
      • setup.exe (PID: 6736)
      • setup.exe (PID: 9192)
      • assistant_installer.exe (PID: 2908)
      • installer.exe (PID: 6652)
      • opera.exe (PID: 2136)
      • opera.exe (PID: 6184)
      • opera.exe (PID: 6032)
      • opera_gx_splash.exe (PID: 8844)
      • opera.exe (PID: 6256)

    • Reads Environment values

      • identity_helper.exe (PID: 8492)

    • Checks supported languages

      • identity_helper.exe (PID: 8492)
      • OperaGXSetup.exe (PID: 8808)
      • setup.exe (PID: 1348)
      • setup.exe (PID: 9212)
      • setup.exe (PID: 6736)
      • setup.exe (PID: 8380)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4200)
      • setup.exe (PID: 9192)
      • assistant_installer.exe (PID: 5056)
      • installer.exe (PID: 6652)
      • installer.exe (PID: 3024)
      • assistant_installer.exe (PID: 2908)
      • opera.exe (PID: 2136)
      • opera_crashreporter.exe (PID: 8484)
      • opera.exe (PID: 6032)
      • opera.exe (PID: 6184)
      • opera.exe (PID: 5640)
      • opera.exe (PID: 1804)
      • opera.exe (PID: 7100)
      • opera.exe (PID: 3804)
      • opera.exe (PID: 4380)
      • opera.exe (PID: 3016)
      • opera.exe (PID: 3976)
      • opera_gx_splash.exe (PID: 8844)
      • opera.exe (PID: 6256)
      • opera_crashreporter.exe (PID: 496)
      • opera.exe (PID: 2084)
      • opera.exe (PID: 2332)
      • opera.exe (PID: 6036)
      • opera.exe (PID: 8368)
      • opera.exe (PID: 9168)
      • opera.exe (PID: 4024)
      • opera.exe (PID: 9188)
      • opera.exe (PID: 8332)
      • opera.exe (PID: 8344)
      • opera.exe (PID: 2980)
      • opera.exe (PID: 4740)
      • opera.exe (PID: 8396)

    • Application launched itself

      • msedge.exe (PID: 7540)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7540)
      • msedge.exe (PID: 10936)

    • Create files in a temporary directory

      • OperaGXSetup.exe (PID: 8808)
      • setup.exe (PID: 9212)
      • setup.exe (PID: 1348)
      • setup.exe (PID: 6736)
      • setup.exe (PID: 8380)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4200)
      • setup.exe (PID: 9192)
      • installer.exe (PID: 3024)
      • installer.exe (PID: 6652)
      • opera.exe (PID: 2136)

    • Checks proxy server information

      • setup.exe (PID: 6736)
      • opera.exe (PID: 2136)

    • The sample compiled with english language support

      • setup.exe (PID: 9212)
      • setup.exe (PID: 6736)
      • setup.exe (PID: 1348)
      • setup.exe (PID: 9192)
      • setup.exe (PID: 8380)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4200)
      • installer.exe (PID: 3024)
      • installer.exe (PID: 6652)
      • installer.exe (PID: 9648)
      • installer.exe (PID: 10676)
      • opera_autoupdate.exe (PID: 5956)
      • installer.exe (PID: 11184)
      • msedge.exe (PID: 10936)
      • opera.exe (PID: 10620)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 6736)
      • opera.exe (PID: 2136)

    • Reads the software policy settings

      • setup.exe (PID: 6736)
      • slui.exe (PID: 4892)

    • Creates files or folders in the user directory

      • setup.exe (PID: 6736)
      • setup.exe (PID: 1348)
      • setup.exe (PID: 9192)
      • installer.exe (PID: 6652)
      • opera.exe (PID: 2136)
      • opera.exe (PID: 6184)

    • OPERA mutex has been found

      • opera.exe (PID: 2136)

    • Process checks computer location settings

      • opera.exe (PID: 2136)
      • opera.exe (PID: 3804)
      • opera.exe (PID: 2084)
      • opera.exe (PID: 6036)
      • opera.exe (PID: 4740)

    • Manual execution by a user

      • opera.exe (PID: 6256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
304
Monitored processes
169
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs operagxsetup.exe setup.exe setup.exe setup.exe setup.exe setup.exe msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe assistant_installer.exe no specs assistant_installer.exe no specs msedge.exe no specs installer.exe installer.exe msedge.exe no specs opera.exe opera_crashreporter.exe no specs msedge.exe no specs opera.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera_gx_splash.exe no specs msedge.exe no specs opera.exe no specs opera_crashreporter.exe no specs msedge.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs comppkgsrv.exe no specs opera_autoupdate.exe installer.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera_autoupdate.exe opera.exe no specs opera_autoupdate.exe no specs installer.exe opera_autoupdate.exe no specs opera.exe no specs msedge.exe no specs msedge.exe no specs opera.exe no specs msedge.exe no specs installer.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs msedge.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs opera.exe no specs msedge.exe no specs opera.exe opera.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Users\admin\AppData\Local\Programs\Opera GX\118.0.5461.120\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=118.0.5461.120 --initial-client-data=0x210,0x214,0x218,0x20c,0x21c,0x7ffc69626dd8,0x7ffc69626de8,0x7ffc69626df8C:\Users\admin\AppData\Local\Programs\Opera GX\118.0.5461.120\opera_crashreporter.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera GX crash-reporter
Exit code:
0
Version:
118.0.5461.120
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\118.0.5461.120\opera_crashreporter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=8348 --field-trial-handle=2284,i,18360134200822760031,17666300141551995260,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6456 --field-trial-handle=2284,i,18360134200822760031,17666300141551995260,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348C:\Users\admin\AppData\Local\Temp\7zS86273DD1\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=118.0.5461.120 --initial-client-data=0x280,0x284,0x288,0x258,0x28c,0x7ffc898b1b88,0x7ffc898b1b94,0x7ffc898b1ba0C:\Users\admin\AppData\Local\Temp\7zS86273DD1\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera GX Installer
Exit code:
0
Version:
118.0.5461.120
Modules
Images
c:\users\admin\appdata\local\temp\7zs86273dd1\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1672"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6964 --field-trial-handle=2284,i,18360134200822760031,17666300141551995260,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1804"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:aria-in-tab-view=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-april1st=on --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:hide-navigations-from-extensions=on --with-feature:panic-button=on --with-feature:play-again=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:installer-experiment-test=off --ab_tests=GXCTest25-ref:DNA-99214_GXCTest25 --field-trial-handle=3148,i,13710240711739594960,18044575215088325649,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Exit code:
0
Version:
118.0.5461.120
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\118.0.5461.120\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
2084"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 OPR/118.0.0.0 (Edition std-2)" --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:aria-in-tab-view=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-april1st=on --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:hide-navigations-from-extensions=on --with-feature:panic-button=on --with-feature:play-again=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:installer-experiment-test=off --ab_tests=GXCTest25-ref:DNA-99214_GXCTest25 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1156,i,13710240711739594960,18044575215088325649,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Version:
118.0.5461.120
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\118.0.5461.120\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
2136"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --start-maximizedC:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe
installer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera GX Internet Browser
Version:
118.0.5461.120
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\118.0.5461.120\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2332"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 OPR/118.0.0.0 (Edition std-2)" --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=on --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:aria-in-tab-view=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-april1st=on --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:hide-navigations-from-extensions=on --with-feature:panic-button=on --with-feature:play-again=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:installer-experiment-test=off --ab_tests=GXCTest25-ref:DNA-99214_GXCTest25 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4928,i,13710240711739594960,18044575215088325649,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:2C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Version:
118.0.5461.120
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\118.0.5461.120\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
Total events
26 801
Read events
25 710
Write events
1 074
Delete events
17

Modification events

(PID) Process:(7540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590570
Operation:writeName:WindowTabManagerFileMappingId
Value:
{CC20CB63-1448-4F40-9F28-828DC4BAB9DD}
(PID) Process:(7540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590570
Operation:writeName:WindowTabManagerFileMappingId
Value:
{4C45685B-4CCD-4D88-A303-0324EF039E63}
(PID) Process:(7540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590570
Operation:writeName:WindowTabManagerFileMappingId
Value:
{9D97DBEA-2E48-46FD-8D49-3519B1AD2F97}
(PID) Process:(7540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590570
Operation:writeName:WindowTabManagerFileMappingId
Value:
{224AB960-C7A7-4AAA-A710-A3C01ACE4118}
(PID) Process:(7540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590570
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5696EF29-1F8E-4A32-9325-9E4D51B6DC64}
(PID) Process:(7540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590570
Operation:writeName:WindowTabManagerFileMappingId
Value:
{AA5687B3-A101-4FC8-B0F9-DB78D27C3D8D}
(PID) Process:(7404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
64
Suspicious files
1 538
Text files
673
Unknown types
3

Dropped files

PID
Process
Filename
Type
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10bfd7.TMP —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10bfd7.TMP —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10bfe7.TMP —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10bfe7.TMP —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10bff6.TMP —
MD5:—
SHA256:—
7540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
429
DNS requests
512
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2344
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1747705131&P2=404&P3=2&P4=No99Tb22ED8ggOiwJ2leKOe454Z16EpaNAj2fX7UFX3b%2fm62Dc6i5EFDnQ0%2f%2fzX%2fakpDG%2fkcHA%2feTOXAdp2kHA%3d%3d
unknown
—
—
whitelisted
2344
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1747705131&P2=404&P3=2&P4=No99Tb22ED8ggOiwJ2leKOe454Z16EpaNAj2fX7UFX3b%2fm62Dc6i5EFDnQ0%2f%2fzX%2fakpDG%2fkcHA%2feTOXAdp2kHA%3d%3d
unknown
—
—
whitelisted
2344
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1747705131&P2=404&P3=2&P4=S8SvqWsdQPBudtANnnPIN4YMRtKzLgjCNWRRTPM2ztvYGzJREs8FWkwb8s03N4IxTQpkHI5qpFGAk2fY5IfGuA%3d%3d
unknown
—
—
whitelisted
2344
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1747705131&P2=404&P3=2&P4=No99Tb22ED8ggOiwJ2leKOe454Z16EpaNAj2fX7UFX3b%2fm62Dc6i5EFDnQ0%2f%2fzX%2fakpDG%2fkcHA%2feTOXAdp2kHA%3d%3d
unknown
—
—
whitelisted
2344
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1747705131&P2=404&P3=2&P4=No99Tb22ED8ggOiwJ2leKOe454Z16EpaNAj2fX7UFX3b%2fm62Dc6i5EFDnQ0%2f%2fzX%2fakpDG%2fkcHA%2feTOXAdp2kHA%3d%3d
unknown
—
—
whitelisted
2344
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1747705131&P2=404&P3=2&P4=S8SvqWsdQPBudtANnnPIN4YMRtKzLgjCNWRRTPM2ztvYGzJREs8FWkwb8s03N4IxTQpkHI5qpFGAk2fY5IfGuA%3d%3d
unknown
—
—
whitelisted
6736
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7540
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7776
msedge.exe
104.17.150.117:443
www.mediafire.com
—
—
whitelisted
7776
msedge.exe
172.67.199.186:443
the.gatekeeperconsent.com
—
—
unknown
7776
msedge.exe
104.17.151.117:443
www.mediafire.com
—
—
whitelisted
7776
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.mediafire.com
  • 104.17.151.117
  • 104.17.150.117
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
  • 74.125.206.157
  • 74.125.206.155
  • 74.125.206.156
  • 74.125.206.154
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.154
  • 104.126.37.123
  • 104.126.37.129
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.136
  • 104.126.37.186
  • 104.126.37.163
  • 2.19.96.27
  • 2.19.96.16
  • 2.19.96.106
  • 2.19.96.83
  • 2.19.96.74
  • 2.19.96.11
  • 2.19.96.90
  • 2.19.96.49
  • 2.19.96.66
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7776
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7776
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7776
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7776
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7776
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7776
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7776
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7776
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7776
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/00gqhnvmrzi62jm/mame+plus+++6000+roms+++extras+deluxe+-+byrafailo-f1.torrent/file?dkey=ciisul49w21&r=1354