File name:

OperaSetupBeta.exe

Full analysis: https://app.any.run/tasks/1ce63739-1d1e-48f5-9a0d-24fd9cd4617c
Verdict: Malicious activity
Analysis date: April 23, 2025, 22:54:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

5E426572F3089BDE745194FBBFB04362

SHA1:

7DAC84900BD4E1AAB8C237836F61A964CDABC8E2

SHA256:

EFDFD06AA26DB8F8E9EB35739A7A4D8530E331668E2161759081BDB44558CEF1

SSDEEP:

98304:7wyWSeMgt1t6T97WNVV/Or/wnh4+zv9Weud3ROI23H7JPL0cd+T8Pl10mtZMFt9T:7NNuw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 7428)
      • OperaSetupBeta.exe (PID: 7396)
      • setup.exe (PID: 7452)
      • setup.exe (PID: 7536)
      • setup.exe (PID: 7932)
      • setup.exe (PID: 7908)

    • Application launched itself

      • setup.exe (PID: 7428)
      • setup.exe (PID: 7908)

    • Starts itself from another location

      • setup.exe (PID: 7428)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 7428)
      • setup.exe (PID: 7908)
      • setup.exe (PID: 7452)
      • setup.exe (PID: 7932)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 7428)

  • INFO

    • Create files in a temporary directory

      • OperaSetupBeta.exe (PID: 7396)
      • setup.exe (PID: 7452)
      • setup.exe (PID: 7536)
      • setup.exe (PID: 7428)
      • setup.exe (PID: 7932)
      • setup.exe (PID: 7908)

    • Checks supported languages

      • OperaSetupBeta.exe (PID: 7396)
      • setup.exe (PID: 7452)
      • setup.exe (PID: 7536)
      • setup.exe (PID: 7908)
      • setup.exe (PID: 7428)
      • setup.exe (PID: 7932)

    • The sample compiled with english language support

      • setup.exe (PID: 7428)
      • OperaSetupBeta.exe (PID: 7396)
      • setup.exe (PID: 7536)
      • setup.exe (PID: 7452)
      • setup.exe (PID: 7932)
      • setup.exe (PID: 7908)

    • Reads the computer name

      • setup.exe (PID: 7428)
      • setup.exe (PID: 7908)

    • Reads the software policy settings

      • setup.exe (PID: 7428)
      • slui.exe (PID: 8044)

    • Checks proxy server information

      • setup.exe (PID: 7428)
      • slui.exe (PID: 8044)

    • Creates files or folders in the user directory

      • setup.exe (PID: 7428)
      • setup.exe (PID: 7452)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 7428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:12 14:57:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 238080
InitializedDataSize: 113152
UninitializedDataSize: -
EntryPoint: 0x213c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 119.0.5497.12
ProductVersionNumber: 119.0.5497.12
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 119.0.5497.12
ProductVersion: 119.0.5497.12
FileDescription: Opera installer SFX
CompanyName:
LegalCopyright: Opera Software 2025
Productname: Opera beta installer
Stream: beta
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start operasetupbeta.exe setup.exe setup.exe setup.exe setup.exe setup.exe slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7396"C:\Users\admin\Desktop\OperaSetupBeta.exe" C:\Users\admin\Desktop\OperaSetupBeta.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Opera installer SFX
Version:
119.0.5497.12
Modules
Images
c:\users\admin\desktop\operasetupbeta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7428C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe --server-tracking-blob=OTFmYWEzYzcyOTZhOTRhMzY4ODdjMGIzZTFkM2I4Zjg2MjdhMzNkMzNiNjMyNmYwOGJkYzE1NDllNzg2YzA2ZDp7ImNvdW50cnkiOiJERSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwQmV0YS5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9iZXRhL3dpbmRvd3M/dXRtX3NvdXJjZT0lMjhkaXJlY3QlMjkmdXRtX21lZGl1bT1kb2MmdXRtX2NhbXBhaWduPSUyOGRpcmVjdCUyOSZodHRwX3JlZmVycmVyPW1pc3NpbmcmdXRtX3NpdGU9b3BlcmFfY29tJmRsX3Rva2VuPTg3NzY5OTcxIiwidGltZXN0YW1wIjoiMTc0NTQ0ODc4Ni4zOTc5IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjAuMCBTYWZhcmkvNTM3LjM2IEVkZy8xMjIuMC4wLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiIoZGlyZWN0KSIsIm1lZGl1bSI6ImRvYyIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiIoZGlyZWN0KSJ9LCJ1dWlkIjoiZTlkYzk1NWEtNDU2NS00YjZlLWIyMDgtNWM1NGI5NmFlOTViIn0=C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe
OperaSetupBeta.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera beta Installer
Version:
119.0.5497.12
Modules
Images
c:\users\admin\appdata\local\temp\7zs4ec6e280\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7452C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Next\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Next\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=beta --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=119.0.5497.12 --initial-client-data=0x2a0,0x2a4,0x2a8,0x274,0x2ac,0x7ffc89a08c88,0x7ffc89a08c94,0x7ffc89a08ca0C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera beta Installer
Version:
119.0.5497.12
Modules
Images
c:\users\admin\appdata\local\temp\7zs4ec6e280\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7536"C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --versionC:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
setup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera installer temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7908"C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\admin\AppData\Local\Programs\Opera beta" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=0 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=7428 --package-dir-prefix="C:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20250423225453" --session-guid=a1b77472-06ad-4067-8218-102f00edd702 --server-tracking-blob=OTQzNzJjZjk5MTYxOGQ4NmQ3OGQ1MGU4ZTE3M2FiNmI2ODc3ZWJlODBhMTNjZDA1M2E5MmZlYWE1ZGM4NTI3NTp7ImNvdW50cnkiOiJERSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwQmV0YS5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9iZXRhL3dpbmRvd3M/dXRtX3NvdXJjZT0lMjhkaXJlY3QlMjkmdXRtX21lZGl1bT1kb2MmdXRtX2NhbXBhaWduPSUyOGRpcmVjdCUyOSZodHRwX3JlZmVycmVyPW1pc3NpbmcmdXRtX3NpdGU9b3BlcmFfY29tJmRsX3Rva2VuPTg3NzY5OTcxIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzQ1NDQ4Nzg2LjM5NzkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEyMi4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IihkaXJlY3QpIiwibWVkaXVtIjoiZG9jIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IihkaXJlY3QpIn0sInV1aWQiOiJlOWRjOTU1YS00NTY1LTRiNmUtYjIwOC01YzU0Yjk2YWU5NWIifQ== --desktopshortcut=1 --wait-for-package --initial-proc-handle=240A000000000000C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera beta Installer
Version:
119.0.5497.12
Modules
Images
c:\users\admin\appdata\local\temp\7zs4ec6e280\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7932C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Next\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Next\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=beta --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=119.0.5497.12 --initial-client-data=0x298,0x29c,0x2ac,0x274,0x2b0,0x7ffc88048c88,0x7ffc88048c94,0x7ffc88048ca0C:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera beta Installer
Version:
119.0.5497.12
Modules
Images
c:\users\admin\appdata\local\temp\7zs4ec6e280\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
8044C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
7 004
Read events
7 000
Write events
4
Delete events
0

Modification events

(PID) Process:(7428) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7428) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7428) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7908) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera Software
Operation:writeName:Last beta Install Path
Value:
C:\Users\admin\AppData\Local\Programs\Opera beta\
Executable files
7
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7428setup.exeC:\Users\admin\AppData\Roaming\Opera Software\Opera Next\Crash Reports\settings.datbinary
MD5:269D1BD359F648D13579D2C9E4C52785
SHA256:800D625504DDB71338B16A04193A2DAFE045F8CA0ECE7F7E1219261BBD9A7883
7428setup.exeC:\Users\admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exeexecutable
MD5:C975215CA08D94B8D2F196C9253E814A
SHA256:5829920F0C2E61D9F6D112413EBE0C3EF3401E0E9E71D51708086891D205FC7D
7396OperaSetupBeta.exeC:\Users\admin\AppData\Local\Temp\7zS4EC6E280\setup.exeexecutable
MD5:C975215CA08D94B8D2F196C9253E814A
SHA256:5829920F0C2E61D9F6D112413EBE0C3EF3401E0E9E71D51708086891D205FC7D
7452setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2504232254532437452.dllexecutable
MD5:F997D11D38634CA49793DCB4234F3454
SHA256:90507670BFB28EE26C4E2C6BFCC91C40F7D76C6E0FDF02D15A5C46C051FE1BEB
7536setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2504232254535567536.dllexecutable
MD5:F997D11D38634CA49793DCB4234F3454
SHA256:90507670BFB28EE26C4E2C6BFCC91C40F7D76C6E0FDF02D15A5C46C051FE1BEB
7932setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2504232255215087932.dllexecutable
MD5:F997D11D38634CA49793DCB4234F3454
SHA256:90507670BFB28EE26C4E2C6BFCC91C40F7D76C6E0FDF02D15A5C46C051FE1BEB
7428setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2504232254529777428.dllexecutable
MD5:F997D11D38634CA49793DCB4234F3454
SHA256:90507670BFB28EE26C4E2C6BFCC91C40F7D76C6E0FDF02D15A5C46C051FE1BEB
7428setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\features[1].jsonbinary
MD5:529D10299380D93519FCAEC99A5848DC
SHA256:A5CF223A6DA9A3D268F5875900573E40CFC02DFC88A25F79C1858176EFC561BB
7908setup.exeC:\Users\admin\AppData\Local\Temp\Opera_installer_2504232255213057908.dllexecutable
MD5:F997D11D38634CA49793DCB4234F3454
SHA256:90507670BFB28EE26C4E2C6BFCC91C40F7D76C6E0FDF02D15A5C46C051FE1BEB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
76
DNS requests
23
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
404
104.18.24.17:443
https://api.config.opr.gg/v0/config?utm_campaign=(direct)&utm_medium=doc&utm_source=(direct)&product=&channel=beta&client=netinstaller&edition=
unknown
—
—
—
—
—
GET
302
3.67.48.43:443
https://download.opera.com/download/get/?id=71171&autoupdate=1&ni=1&stream=beta&utm_campaign=(direct)&utm_medium=doc&utm_site=opera_com&utm_source=(direct)&niuid=e9dc955a-4565-4b6e-b208-5c54b96ae95b
unknown
—
—
—
—
—
GET
—
104.18.11.89:443
https://download5.operacdn.com/ftp/pub/opera-beta/119.0.5497.12/win/Opera_beta_119.0.5497.12_Autoupdate_x64.exe
unknown
—
—
—
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
POST
200
40.126.31.73:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
20.190.159.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
201
82.145.217.121:443
https://desktop-netinstaller-sub.osp.opera.software/v1/binary
unknown
text
36 b
whitelisted
—
—
GET
200
185.26.182.124:443
https://autoupdate.opera.com/me/
unknown
binary
46 b
whitelisted
—
—
POST
200
185.26.182.123:443
https://autoupdate.opera.com/v5/netinstaller/opera/beta/windows/x64
unknown
binary
783 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6544
svchost.exe
40.126.31.129:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.126.31.129:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7428
setup.exe
82.145.217.121:443
desktop-netinstaller-sub.osp.opera.software
Opera Software AS
NO
whitelisted
7428
setup.exe
185.26.182.124:443
autoupdate.opera.com
Opera Software AS
—
whitelisted
7428
setup.exe
82.145.216.59:443
features.opera-api2.com
Opera Software AS
NO
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
google.com
  • 216.58.206.78
whitelisted
desktop-netinstaller-sub.osp.opera.software
  • 82.145.217.121
whitelisted
autoupdate.opera.com
  • 185.26.182.124
  • 185.26.182.123
whitelisted
features.opera-api2.com
  • 82.145.216.59
  • 82.145.216.16
  • 82.145.216.15
  • 82.145.216.58
malicious
api.config.opr.gg
  • 104.18.25.17
  • 104.18.24.17
unknown
download.opera.com
  • 82.145.216.24
  • 82.145.216.23
  • 82.145.216.49
  • 82.145.216.48
whitelisted
download5.operacdn.com
  • 104.18.10.89
  • 104.18.11.89
malicious

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO Outgoing Basic Auth Base64 HTTP Password detected unencrypted
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OperaSetupBeta.exe