File scan report

Verdict Low Risk

Analyzed Oct 18, 20268 days ago

Is OperaGXSetup.exe safe? Not fully confirmed.

This unsigned installer behaves like Opera GX setup and none of the 70 antivirus engines that checked it flagged it, but the missing signature and short history (seen shortly…

Read the whole reasonShow less

Why not Safe? It has no verified publisher signature and only 2 sources had seen it when we scanned it.

Limited evidence · Nothing points to a problem, but little confirms who made it.

Keep normal caution and get it from the official source

Get Opera GX from Opera's official website and confirm the installer is signed by Opera before running it. Avoid this unsigned copy if you cannot verify where it came from.

Good practice2 tips

Low Risk: no threat found, but we could not fully confirm this file.

Get it from the publisher's own website or app store, not from a re-upload or a link someone sent you.
Keep your security software on, and stop if the file does anything you didn't expect.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 70 flagged

Flagged 0
No detection 70
No result 5

FileOperaGXSetup.exe4.2 MBSHA-256 e3c33d59b964…644814

Code signing Unsigned
Test run Completed
First seen 8d ago

When we scanned it, 2 sources had submitted it to VirusTotal.

Chapter 02

Why we think so

2 points against it and 4 in its favour, checked against the scan evidence.

Analyst conclusion

None of the 70 antivirus engines that checked it flagged this file, and the sandbox runs show a typical Opera GX installation contacting Opera servers. However, the file carries no digital signature and has only been seen by two submitters when we scanned it on Oct 18, 2026. That makes it impossible to confirm it is the official Opera release.

Where this verdict could be wrong1 caveat

Every engine, every external database and the sandbox runs found nothing hostile, and the activity in the test run matches a genuine Opera GX installation, so the file may well be a legitimate Opera build.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 5 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

5isolated sandbox runs
34sandbox rule tags
12spawned processes
32network contacts
35filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was detonated in 5 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEANclean

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1003· Credential theft
T1005
T1014
T1027· Obfuscated code
T1033· Reads user info
T1036
T1047
T1055· Process injection
T1057· Lists programs
T1059· Runs commands
T1069
T1070· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1106
T1129· Loads modules
T1222
T1485
T1486· File encryption
T1497· Sandbox evasion
T1542
T1542.003
T1548
T1552· Credential search
T1552.001· Credential search
T1553
T1553.002
T1555· Password stealing
T1555.003· Password stealing
T1562· Disables security
T1562.001· Disables security
+2 more

Observed activity

Processes started

Programs the file ran, with their command lines.

installer.exe"C:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\installer.exe" --backend --initial-pid=7148 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\<USER>\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_t…
installer.exe"C:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111…
OperaGXSetup.exe"C:\Users\<USER>\Desktop\OperaGXSetup.exe"
installer.exeC:\Users\<USER>\AppData\Local\Temp\7zS07AF8590\installer.exe --server-tracking-blob=YTA3Yzg4ODhhMzhjZTBmNjJhNGY1YWNjZjcwZmNhOGVlODZmYzQ0MzA5ZDBlNGYwOTlhMGE4YzI0MjZiMDk3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19IVlJfOTU3MV9XRUJfNzg0JmVkaXRpb249c3RkLTImdXRtX2lkPTgyZThhNWVhMjQ0NjQzNTdhMzgwOGQzOGI5MDZ…
installer.exeC:\Users\<USER>\AppData\Local\Temp\7zS07AF8590\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-d…
installer.exe"C:\Users\<USER>\AppData\Local\Temp\.opera\5708687a-a9d7-4ae3-9088-e87af7d75223 Opera GX Installer Temp\installer.exe" --version

Show all 12 entries

installer.exe"C:\Users\<USER>\AppData\Local\Temp\7zS07AF8590\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --showunbox=0 --installfolder="C:\Users\<USER>\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7148 --p…
installer.exeC:\Users\<USER>\AppData\Local\Temp\7zS07AF8590\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-d…
Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe"C:\Users\<USER>\AppData\Local\Temp\.opera\5708687a-a9d7-4ae3-9088-e87af7d75223 Opera GX Installer Temp\opera_package_202610180446341\assistant\Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe"
assistant_installer.exe"C:\Users\<USER>\AppData\Local\Temp\.opera\5708687a-a9d7-4ae3-9088-e87af7d75223 Opera GX Installer Temp\opera_package_202610180446341\assistant\assistant_installer.exe" --version
OperaGXSetup.exe"C:\Users\user\Desktop\OperaGXSetup.exe"
installer.exeC:\Users\user\AppData\Local\Temp\7zS4AA36FF3\installer.exe --server-tracking-blob=YTA3Yzg4ODhhMzhjZTBmNjJhNGY1YWNjZjcwZmNhOGVlODZmYzQ0MzA5ZDBlNGYwOTlhMGE4YzI0MjZiMDk3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19IVlJfOTU3MV9XRUJfNzg0JmVkaXRpb249c3RkLTImdXRtX2lkPTgyZThhNWVhMjQ0NjQzNTdhMzgwOGQzOGI5MDZiY…

Network contacts

32 hosts, listed as 20 domains, 12 addresses, 4 links. Links show the host and path only.

Domaindesktop-netinstaller-sub.osp.opera.software
Domainstatusd.digitalcertvalidation.com
Domainfeatures.opera-api2.com
Domainapi.config.opr.gg
Domaindesktop-assistant-sub.osp.opera.software
Domainproxy.gxcorner.games

Show all 36 entries

Domainmerchandise.opera-api2.com
Domaingxcorner.games
Domainmerchandise.opera-api.com
Domainab-merchandise.opera-api.com
Domainco-merchandise.opera-api.com
Domainwww.temu.com
Domainsentry-relay.opera-api.com
Domainplay.gx.games
Domainwww.gstatic.com
Domainapi.gx.me
Domaingx.me
Domainsitecheck.opera.com
Domainspeeddials.opera.com
Domainautoupdate.opera.com
IP address107.167.125.189
IP address107.167.110.211
IP address104.18.25.17
IP address104.18.6.134
IP address107.167.110.216
IP address20.33.69.37
IP address104.18.7.134
IP address104.18.8.172
IP address82.145.216.16
IP address172.217.204.94
IP address104.18.23.55
IP address13.63.64.22
URLhttp://statusd.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRNolijWxrE%2B4oss3hMFE8Heagz1AQU9VYiH9m%2Fa1kkUrDhas3A4Vdn6egCEAaV2Cvjf8%2BY2vZ6CGdVSuk%3D
URLhttps://desktop-netinstaller-sub.osp.opera.software/v1/binary
URLhttps://features.opera-api2.com/api/v2/features
URLhttps://api.config.opr.gg/v0/config

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
WrittenC:\Users\<USER>\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20261017214827879.log
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\resources\custom_partner_content.json
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\files_list.1792298908.old
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\root_files_list.1792298908.old

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100_contrast-white.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140_contrast-white.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180_contrast-white.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80_contrast-white.png
WrittenC:\Users\<USER>\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-100.png
DeletedC:\Users\<USER>\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20261017214827879.log
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\files_list
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\root_files_list
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-100.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-100_contrast-white.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-140.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-140_contrast-white.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-180.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-180_contrast-white.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-80.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\150x150Logo.scale-80_contrast-white.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\70x70Logo.scale-100.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\70x70Logo.scale-100_contrast-white.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\70x70Logo.scale-140.png
DeletedC:\Users\<USER>\AppData\Local\Programs\Opera GX\136.0.6008.111\Assets\70x70Logo.scale-140_contrast-white.png

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

SetHKEY_CURRENT_USER\SOFTWARE\Opera Software\Last Opera GX Stable Install Path
SetHKEY_CURRENT_USER\Software\Classes\Opera GXStable\FriendlyTypeName
SetHKEY_CURRENT_USER\Software\Classes\Opera GXStable\DefaultIcon\(Default)
SetHKEY_CURRENT_USER\Software\Classes\Opera GXStable\shell\open\command\(Default)
SetHKEY_CURRENT_USER\Software\Classes\Applications\opera.exe\shell\open\command\(Default)
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\opera.exe\(Default)

Show all 16 entries

SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\opera.exe\Path
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted\C:\Users\Bruno\AppData\Local\Programs\Opera GX\opera.exe
SetHKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\Opera GX Stable
SetHKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\Opera GXStable\(Default)
SetHKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\Opera GXStable\DefaultIcon\(Default)
SetHKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\Opera GXStable\InstallInfo\IconsVisible
SetHKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\Opera GXStable\shell\open\command\(Default)
SetHKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\Opera GXStable\Capabilities\ApplicationDescription
SetHKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\Opera GXStable\Capabilities\ApplicationIcon
DeletedHKEY_CURRENT_USER\Control Panel\Desktop\TranscodedImageCache_000

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

TaskbarPinListMutex
Global\SyncRootManager
cversions.3.m
Local\Opera GX/Installer/UI_lock
Global\Opera/Installer/C:/Users/Bruno/AppData/Local/Programs/Opera GX

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processExplorer.EXEC:\Windows\Explorer.EXE
VM host224.0.0.251

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

1fbe26479ce3347dd605…c7d05fNot checked
no saved verdict
ca7d5883a0d16362f9ad…f6cb63Not checked
no saved verdict
261c8cea0752fdbc241c…d74b5aNot checked
no saved verdict
407955bd8dc43601214a…55fc52Not checked
no saved verdict
d01d82dcabdae7a38eda…38a0c7Not checked
no saved verdict
e8aa4d45ec4eedf133e0…f885c5Not checked
no saved verdict
65a487c32b2b0fdb5a02…bdf115Not checked
no saved verdict
954c727ab00c979f4fac…68c978Not checked
no saved verdict
2ec4dcc1209a7f59c921…e46050Not checked
no saved verdict
0bae5d3deade6c85b7a4…52e036Not checked
no saved verdict

Network activity

Servers this file contacts

Some hosts this file contacts have only older or low-confidence reports in our URL scanner. They are shown for context and are not counted as evidence.

32 checked

Context only — not counted

www.temu.comolder report (suspicious), Jun 15, 2026

Cross-referenced with our URL scanner cache. Open any host to see its report.

Chapter 04

Technical details

None of the 70 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 70 engines flagged it · 5 gave no result DetailsOct 18, 2026

Sandbox runVirusTotal sandboxes · CAPA, CAPE Sandbox, VirusTotal JujuboxComplete5 runs: 1 clean, 4 without a verdict DetailsOct 18, 2026

Contacted hostsMalwareTips URL scannerComplete32 contacted hosts checked DetailsOct 18, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete2 MalwareTips behaviour rules DetailsOct 18, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 18, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 18, 2026

File fingerprint

Last analyzed: Oct 18, 2026, 4:56 PM UTC

SHA-256: e3c33d59b964b729936a88302b3801f37be0875e2ffd6ef3ed231e9860644814
SHA-1: 4d10b0b2099923a91a75d2e70d35104537303d8c
MD5: 469e69437ad5438faf4a787d9331c6dd

About this file

OperaGXSetup.exe says it is Opera installer SFX (Opera installer), 4.2 MB.

Claims to be: Opera installer SFX (Opera installer)From the file's own version information, written by whoever built it.
Type and size: Win32 EXE · 4.2 MB
Signer: UnsignedNo code signature.
First seen: Oct 18, 2026On VirusTotal.
Submitted by: 2 distinct sourcesRarely seen: few people have submitted this exact file.
Packer: None detected
Entropy: 6.14 of 8

First scanned Oct 18, 2026

Verdict history

Oct 18, 2026Suspicious
Oct 18, 2026Low Riskafter a new scan

Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.

Antivirus consensus

0 of 70 engines flagged this file

0 malicious0 suspicious70 not flagged5 no result

5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-235 engines
0flagged
Low-trust17 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighNo result
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

2 heuristics

MITRE ATT&CK profile

Defense evasion× 1Cred access× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)
CredentialDumper
T1003 T1003.001
low
VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
Evidence
T1003 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 6.14Unpacked

Section entropy5 sections

.text

6.61

.rdata

4.61

.data

4.08

.rsrc

5.26

.reloc

6.52

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Barely seen in the wild and first surfaced recently. That limits reputation evidence, but rarity alone is not proof of malware.

Rare & new

Unique uploaders

Very few people have ever uploaded this — rare.

Total submissions

Includes repeat uploads by the same source.

First seen

8d ago

Oct 18, 2026

Prevalence quadrant

here

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 5 questions people ask most about this file.

Is OperaGXSetup.exe safe?

OperaGXSetup.exe is rated Low Risk: we found no threat, but we could not fully confirm this file. None of the 70 antivirus engines that checked it flag it, but that alone is not enough to call it Safe. Keep normal caution and get it from the official source.

What is OperaGXSetup.exe?

OperaGXSetup.exe is a Windows program, about 4.2 MB. Its version information says it is “Opera installer SFX” (Opera installer). Version information is written by whoever built the file, so it is a claim, not proof of who made it. VirusTotal first saw it on Oct 18, 2026.

How many antivirus engines detected OperaGXSetup.exe?

None of the 70 antivirus engines that checked it flag OperaGXSetup.exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of OperaGXSetup.exe?

The SHA-256 fingerprint of OperaGXSetup.exe is e3c33d59b964b729936a88302b3801f37be0875e2ffd6ef3ed231e9860644814, and its MD5 is 469e69437ad5438faf4a787d9331c6dd. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

How up to date is this analysis of OperaGXSetup.exe?

This report reflects the scan on Oct 18, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is OperaGXSetup.exe safe? Not fully confirmed.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Servers this file contacts

Technical details

Every check behind this verdict

File fingerprint

About this file

Verdict history

0 of 70 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is OperaGXSetup.exe safe? Not fully confirmed.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Verdict history

Related file reports