File name:

Delta V3.61 b_20422796.exe

Full analysis: https://app.any.run/tasks/cbebf45f-8458-4264-b00f-00250680d74a
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 21, 2025, 02:58:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
premieropinion
adware
ossproxy
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

15D1C495FF66BF7CEA8A6D14BFDF0A20

SHA1:

942814521FA406A225522F208AC67F90DBDE0AE7

SHA256:

61C2C4A5D7C14F77EE88871DED4CC7F1E49DAE3E4EF209504C66FEDF4D22DE42

SSDEEP:

98304:DtjM+LgnHM8mNLNpOmMGl2p9tjIQh+1GHp8PGmDFzMVv3kdcpR41TBN14BC6SkPT:Kw8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • Delta V3.61 b_20422796.exe (PID: 7148)

    • PREMIEROPINION mutex has been found

      • ContentI3.exe (PID: 2420)

    • OSSPROXY mutex has been found

      • ContentI3.exe (PID: 2420)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • setup.exe (PID: 5408)
      • ContentI3.exe (PID: 2420)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)

    • Executable content was dropped or overwritten

      • OperaGX.exe (PID: 536)
      • setup.exe (PID: 6744)
      • Delta V3.61 b_20422796.exe (PID: 7148)
      • setup.exe (PID: 5408)
      • setup.exe (PID: 6388)
      • setup.exe (PID: 6656)
      • setup.exe (PID: 2096)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4068)

    • Starts itself from another location

      • setup.exe (PID: 5408)

    • Application launched itself

      • setup.exe (PID: 5408)
      • setup.exe (PID: 6656)
      • assistant_installer.exe (PID: 6148)

    • There is functionality for taking screenshot (YARA)

      • Delta V3.61 b_20422796.exe (PID: 7148)

    • Start notepad (likely ransomware note)

      • Delta V3.61 b_20422796.exe (PID: 7148)

  • INFO

    • The sample compiled with english language support

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • OperaGX.exe (PID: 536)
      • setup.exe (PID: 5408)
      • setup.exe (PID: 6744)
      • setup.exe (PID: 6388)
      • setup.exe (PID: 6656)
      • setup.exe (PID: 2096)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4068)

    • Checks supported languages

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • OperaGX.exe (PID: 536)
      • setup.exe (PID: 6744)
      • setup.exe (PID: 5408)
      • setup.exe (PID: 6388)
      • setup.exe (PID: 2096)
      • ContentI3.exe (PID: 2420)
      • setup.exe (PID: 6656)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4068)
      • assistant_installer.exe (PID: 6148)
      • assistant_installer.exe (PID: 6456)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)

    • Reads the software policy settings

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • setup.exe (PID: 5408)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)

    • Reads the computer name

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • setup.exe (PID: 5408)
      • setup.exe (PID: 6656)
      • ContentI3.exe (PID: 2420)
      • assistant_installer.exe (PID: 6148)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)

    • Creates files or folders in the user directory

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • setup.exe (PID: 6744)
      • setup.exe (PID: 5408)
      • ContentI3.exe (PID: 2420)
      • setup.exe (PID: 6656)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)

    • Checks proxy server information

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • setup.exe (PID: 5408)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)

    • Reads the machine GUID from the registry

      • Delta V3.61 b_20422796.exe (PID: 7148)
      • setup.exe (PID: 5408)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)

    • Create files in a temporary directory

      • setup.exe (PID: 6744)
      • OperaGX.exe (PID: 536)
      • setup.exe (PID: 5408)
      • setup.exe (PID: 6388)
      • setup.exe (PID: 6656)
      • setup.exe (PID: 2096)
      • Delta V3.61 b_20422796.exe (PID: 7148)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4068)

    • Process checks computer location settings

      • Delta V3.61 b_20422796.exe (PID: 7148)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 208)

    • Manual execution by a user

      • Delta V3.61 b_20422796 (1).exe (PID: 5136)
      • Delta V3.61 b_20422796 (1).exe (PID: 1040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:18 17:00:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4353024
InitializedDataSize: 1675776
UninitializedDataSize: -
EntryPoint: 0x398c98
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
18
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start delta v3.61 b_20422796.exe sppextcomobj.exe no specs slui.exe no specs operagx.exe setup.exe setup.exe setup.exe setup.exe setup.exe #PREMIEROPINION contenti3.exe notepad.exe no specs opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe assistant_installer.exe no specs assistant_installer.exe no specs delta v3.61 b_20422796 (1).exe no specs delta v3.61 b_20422796 (1).exe svchost.exe delta v3.61 b_20422796.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\link.txtC:\Windows\SysWOW64\notepad.exe—Delta V3.61 b_20422796.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
536C:\Users\admin\AppData\Local\OperaGX.exe --silent --allusers=0C:\Users\admin\AppData\Local\OperaGX.exe
Delta V3.61 b_20422796.exe
User:
admin
Integrity Level:
HIGH
Description:
Opera installer SFX
Version:
118.0.5461.50
Modules
Images
c:\users\admin\appdata\local\operagx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1040"C:\Users\admin\Desktop\Delta V3.61 b_20422796 (1).exe" C:\Users\admin\Desktop\Delta V3.61 b_20422796 (1).exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Download Manager
Version:
1
Modules
Images
c:\users\admin\desktop\delta v3.61 b_20422796 (1).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2096C:\Users\admin\AppData\Local\Temp\7zS812AEB80\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=118.0.5461.50 --initial-client-data=0x29c,0x2a0,0x2a4,0x268,0x2a8,0x7ffc87e41b08,0x7ffc87e41b14,0x7ffc87e41b20C:\Users\admin\AppData\Local\Temp\7zS812AEB80\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Installer
Version:
118.0.5461.50
Modules
Images
c:\users\admin\appdata\local\temp\7zs812aeb80\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2420"C:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnionC:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Delta V3.61 b_20422796.exe
User:
admin
Company:
VoiceFive Networks, Inc.
Integrity Level:
HIGH
Description:
PremierOpinion Installer
Exit code:
0
Version:
1.0.8.1 (Build 1)
Modules
Images
c:\users\admin\appdata\local\temp\premieropinion\contenti3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4068"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202504210258201\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202504210258201\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Opera installer SFX
Exit code:
0
Version:
73.0.3856.382
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera gx installer temp\opera_package_202504210258201\assistant\opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
4208"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4892C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5136"C:\Users\admin\Desktop\Delta V3.61 b_20422796 (1).exe" C:\Users\admin\Desktop\Delta V3.61 b_20422796 (1).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\desktop\delta v3.61 b_20422796 (1).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
7 924
Read events
7 900
Write events
22
Delete events
2

Modification events

(PID) Process:(7148) Delta V3.61 b_20422796.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7148) Delta V3.61 b_20422796.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7148) Delta V3.61 b_20422796.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7148) Delta V3.61 b_20422796.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera
Operation:writeName:installed
Value:
1
(PID) Process:(5408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6656) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera Software
Operation:writeName:Last Opera GX Stable Install Path
Value:
C:\Users\admin\AppData\Local\Programs\Opera GX\
(PID) Process:(7148) Delta V3.61 b_20422796.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\InstallUnion\1538
Operation:writeName:BundleOfferActionUid
Value:
$qleeb3UQ4J8NkcsX55555
(PID) Process:(7148) Delta V3.61 b_20422796.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\InstallUnion\1538
Operation:writeName:dt_age
Value:
1
Executable files
17
Suspicious files
52
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\service[1].htmtext
MD5:F9D4655BBB31D3745D1D1671E3A09F4A
SHA256:C09DC2BA6150D341E056631E8FBC1A91AFCD6D87759BDE08E75A1FC506641203
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:C22301B5245B697AA0D960E7D3A2D560
SHA256:8E63BB9D833DDFF90DB225799A6B20821540B2A10AB3764EE07767259765DA0E
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:4EA4CE1BD95F33ABA9B7A87445EC4402
SHA256:F71181AB799C4A73329B6F4D32CB69C9C1C8F2C4A221CCCE5DDD5B563AE7D483
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\geo[1].htmtext
MD5:D7821379BFDC90122ED07209E8FFA7BD
SHA256:0C526E0C44C3A5AC2D6BDCD8E55E48B1A97C9B6C4C7E3113AD2C50B6A43C0BA8
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DD2A7AB6E9F505401E82E727A63C7450_B73C7F9C4217B96C2B9DB7FC54C11C60binary
MD5:C9AC5837EE4974CB295E26EB869353CB
SHA256:4646FB156192A51F6CF61D073C07C8D15CED06CA68A67D82848B6AEF18434EB5
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DD2A7AB6E9F505401E82E727A63C7450_B73C7F9C4217B96C2B9DB7FC54C11C60binary
MD5:92F3EFFF6FD158C944ADD59AC5FBCF82
SHA256:5B65A311677FE6BB8354020C9F35E63BFA68616C48ACFE7E612C8CBB088544A2
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:AC81014BD453E1E6C11DB5DAF82902E3
SHA256:1F0EBCA94943F7C56484E60CCFEA071C8F30580E3372C15A91EC71B48AA8D3D3
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
7148Delta V3.61 b_20422796.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66EA5231CCBA62EE55B488395991816E_AF3F9D1AEFE96E7E6830792AA87FA756binary
MD5:95C8F467E8E64DAC264311A97BEA0133
SHA256:A0DFDB033CB0ED43F9FB69275D2C2DAF0B7E2D06EACFC9699E3FA09FD746672C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
58
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7148
Delta V3.61 b_20422796.exe
GET
200
216.58.206.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
7148
Delta V3.61 b_20422796.exe
GET
200
142.250.186.35:80
http://o.pki.goog/s/we1/1Tc/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBS5vtXxph5AskGWsMKefhqdi%2Fy1IAQUkHeSNWfE%2F6jMqeZ72YB5e8yT%2BTgCEQDVN15cmjtXkA7yMQ44GQuN
unknown
—
—
whitelisted
7148
Delta V3.61 b_20422796.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
7148
Delta V3.61 b_20422796.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=1&uid=$qleeb3UQ4J8NkcsX55555
unknown
—
—
malicious
7148
Delta V3.61 b_20422796.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=17&uid=$qleeb3UQ4J8NkcsX55555
unknown
—
—
malicious
7148
Delta V3.61 b_20422796.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=0
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7148
Delta V3.61 b_20422796.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
7148
Delta V3.61 b_20422796.exe
216.58.206.67:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.dlsft.com
  • 35.190.60.70
unknown
ocsp.pki.goog
  • 216.58.206.67
whitelisted
c.pki.goog
  • 142.250.186.99
whitelisted
o.pki.goog
  • 142.250.186.35
whitelisted
dlsft.com
  • 35.190.60.70
unknown
filedm.com
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.16.1
  • 104.21.48.1
  • 104.21.80.1
  • 104.21.96.1
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Delta V3.61 b_20422796.exe