File name:

Delta V3.61 b_53796675.exe

Full analysis: https://app.any.run/tasks/e07c9ba1-8ab9-47e2-b547-e2a968b662c0
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 02, 2025, 23:13:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
premieropinion
adware
ossproxy
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

15D1C495FF66BF7CEA8A6D14BFDF0A20

SHA1:

942814521FA406A225522F208AC67F90DBDE0AE7

SHA256:

61C2C4A5D7C14F77EE88871DED4CC7F1E49DAE3E4EF209504C66FEDF4D22DE42

SSDEEP:

98304:DtjM+LgnHM8mNLNpOmMGl2p9tjIQh+1GHp8PGmDFzMVv3kdcpR41TBN14BC6SkPT:Kw8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PREMIEROPINION mutex has been found

      • ContentI3.exe (PID: 2324)
      • ContentI3.exe (PID: 3820)

    • OSSPROXY mutex has been found

      • ContentI3.exe (PID: 2324)
      • ContentI3.exe (PID: 3820)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3144)
      • Delta V3.61 b_53796675.exe (PID: 3640)

    • Reads security settings of Internet Explorer

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3144)
      • ContentI3.exe (PID: 2324)
      • Delta V3.61 b_53796675.exe (PID: 3640)
      • ContentI3.exe (PID: 3820)

    • Executable content was dropped or overwritten

      • OperaGX.exe (PID: 4300)
      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 4708)
      • setup.exe (PID: 3144)
      • setup.exe (PID: 5544)
      • setup.exe (PID: 3808)
      • setup.exe (PID: 3620)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5212)

    • Application launched itself

      • setup.exe (PID: 3144)
      • setup.exe (PID: 5544)
      • assistant_installer.exe (PID: 6552)

    • Starts itself from another location

      • setup.exe (PID: 3144)

    • There is functionality for taking screenshot (YARA)

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3620)
      • setup.exe (PID: 4708)
      • setup.exe (PID: 5544)
      • Delta V3.61 b_53796675.exe (PID: 3640)
      • setup.exe (PID: 3144)

    • Start notepad (likely ransomware note)

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • Delta V3.61 b_53796675.exe (PID: 3640)

  • INFO

    • The sample compiled with english language support

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3144)
      • OperaGX.exe (PID: 4300)
      • setup.exe (PID: 4708)
      • setup.exe (PID: 3808)
      • setup.exe (PID: 5544)
      • setup.exe (PID: 3620)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5212)

    • Reads the computer name

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3144)
      • setup.exe (PID: 5544)
      • ContentI3.exe (PID: 2324)
      • identity_helper.exe (PID: 7052)
      • Delta V3.61 b_53796675.exe (PID: 3640)
      • ContentI3.exe (PID: 3820)
      • assistant_installer.exe (PID: 6552)

    • Checks supported languages

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • OperaGX.exe (PID: 4300)
      • setup.exe (PID: 4708)
      • setup.exe (PID: 3144)
      • setup.exe (PID: 3808)
      • setup.exe (PID: 3620)
      • setup.exe (PID: 5544)
      • ContentI3.exe (PID: 2324)
      • identity_helper.exe (PID: 7052)
      • Delta V3.61 b_53796675.exe (PID: 3640)
      • ContentI3.exe (PID: 3820)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5212)
      • assistant_installer.exe (PID: 6552)
      • assistant_installer.exe (PID: 6760)

    • Creates files or folders in the user directory

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 4708)
      • setup.exe (PID: 3144)
      • ContentI3.exe (PID: 2324)
      • ContentI3.exe (PID: 3820)
      • Delta V3.61 b_53796675.exe (PID: 3640)
      • setup.exe (PID: 5544)

    • Checks proxy server information

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3144)
      • Delta V3.61 b_53796675.exe (PID: 3640)

    • Reads the machine GUID from the registry

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3144)
      • Delta V3.61 b_53796675.exe (PID: 3640)

    • Reads the software policy settings

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • setup.exe (PID: 3144)
      • Delta V3.61 b_53796675.exe (PID: 3640)

    • Create files in a temporary directory

      • OperaGX.exe (PID: 4300)
      • setup.exe (PID: 4708)
      • setup.exe (PID: 3144)
      • setup.exe (PID: 3808)
      • setup.exe (PID: 5544)
      • setup.exe (PID: 3620)
      • Delta V3.61 b_53796675.exe (PID: 1684)
      • Delta V3.61 b_53796675.exe (PID: 3640)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5212)

    • Process checks computer location settings

      • Delta V3.61 b_53796675.exe (PID: 1684)
      • Delta V3.61 b_53796675.exe (PID: 3640)

    • Manual execution by a user

      • msedge.exe (PID: 3260)
      • Delta V3.61 b_53796675.exe (PID: 3640)
      • Delta V3.61 b_53796675.exe (PID: 2224)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 5580)
      • notepad.exe (PID: 6220)

    • Application launched itself

      • msedge.exe (PID: 3260)
      • msedge.exe (PID: 6408)

    • Reads Environment values

      • identity_helper.exe (PID: 7052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:18 17:00:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4353024
InitializedDataSize: 1675776
UninitializedDataSize: -
EntryPoint: 0x398c98
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
182
Monitored processes
53
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start delta v3.61 b_53796675.exe operagx.exe setup.exe setup.exe setup.exe setup.exe setup.exe #PREMIEROPINION contenti3.exe notepad.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs delta v3.61 b_53796675.exe no specs delta v3.61 b_53796675.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #PREMIEROPINION contenti3.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs notepad.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe assistant_installer.exe assistant_installer.exe no specs msedge.exe no specs delta v3.61 b_53796675.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4968 --field-trial-handle=2364,i,6948468037661927684,1914962891674751071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1480"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4084 --field-trial-handle=2348,i,5504954052568464183,9791830561062043029,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1580"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5064 --field-trial-handle=2364,i,6948468037661927684,1914962891674751071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1612"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=1628 --field-trial-handle=2364,i,6948468037661927684,1914962891674751071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1684"C:\Users\admin\Downloads\Delta V3.61 b_53796675.exe" C:\Users\admin\Downloads\Delta V3.61 b_53796675.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Download Manager
Exit code:
0
Version:
1
Modules
Images
c:\users\admin\downloads\delta v3.61 b_53796675.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=2364,i,6948468037661927684,1914962891674751071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2076"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4328 --field-trial-handle=2348,i,5504954052568464183,9791830561062043029,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2224"C:\Users\admin\Downloads\Delta V3.61 b_53796675.exe" C:\Users\admin\Downloads\Delta V3.61 b_53796675.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\downloads\delta v3.61 b_53796675.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2324"C:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnionC:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Delta V3.61 b_53796675.exe
User:
admin
Company:
VoiceFive Networks, Inc.
Integrity Level:
HIGH
Description:
PremierOpinion Installer
Exit code:
0
Version:
1.0.8.1 (Build 1)
Modules
Images
c:\users\admin\appdata\local\temp\premieropinion\contenti3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
14 766
Read events
14 706
Write events
56
Delete events
4

Modification events

(PID) Process:(1684) Delta V3.61 b_53796675.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1684) Delta V3.61 b_53796675.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1684) Delta V3.61 b_53796675.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1684) Delta V3.61 b_53796675.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera
Operation:writeName:installed
Value:
1
(PID) Process:(3144) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3144) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3144) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5544) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera Software
Operation:writeName:Last Opera GX Stable Install Path
Value:
C:\Users\admin\AppData\Local\Programs\Opera GX\
(PID) Process:(1684) Delta V3.61 b_53796675.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\InstallUnion\1538
Operation:writeName:BundleOfferActionUid
Value:
KNTAThqhQqAGiWD1a55555
(PID) Process:(1684) Delta V3.61 b_53796675.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\InstallUnion\1538
Operation:writeName:dt_gender
Value:
m
Executable files
68
Suspicious files
740
Text files
84
Unknown types
2

Dropped files

PID
Process
Filename
Type
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\923CD0F3EDBB3759A875E7FE664C6C90_E177412028F15791C29E67CACD8927FCbinary
MD5:66704D1C86D9F585B675B28019F0C813
SHA256:ECB832EE79079EDCC8AB9DC365BD49BCED98E5E90F1B68DEA359F75D7CB02262
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517binary
MD5:EA2E84808A6C8B8D823C72455A8A48FE
SHA256:46C98E047C4B76EBBB12CE60A016B7733707129C658BFA93012AD96A3C6460F9
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\923CD0F3EDBB3759A875E7FE664C6C90_E177412028F15791C29E67CACD8927FCbinary
MD5:AB1AA583797F120F4E08D9A55B9BC8A5
SHA256:859DDA59FA032C11657719ACCCA7DEA7625682B175E00B523C9152B9F3678F8F
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C2C9D7FCC58B6FD9BF152E66809C1BBE_9962014287DF49023620C3F0C27B8ACEbinary
MD5:E390945BE94E78CADB948AF24A40424E
SHA256:768546C25774F83C6033B1C1F4AD87E2E752EB3CB6EE4BCDA1734773EB75B711
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:9ABE05FC27B55656236C495A3AD18724
SHA256:09A444B49C3D31C5118E152FF5056381C4F825A88F378EB3C5FFC614AB716193
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C2C9D7FCC58B6FD9BF152E66809C1BBE_9962014287DF49023620C3F0C27B8ACEbinary
MD5:67972AE252B8A371906293D5D56CC923
SHA256:7FE17418F376D956A43C9EEC0BA308D2E212F8BC499DF62DA1F6BD810C79FA31
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:5EB6B57605138EB2CBF96B982DD5AED1
SHA256:A2AC01D986DBD526E42BC02E58DF32D2C713EC1AA57CF7B9EB9F42A80FF5BF96
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\83D863F495E7D991917B3ABB3E1EB382_4D9C2C5E642FAF6FA3B8098AB3241EF2binary
MD5:06477F7E830400894F3110DBB00A5110
SHA256:806C3EBB8EF3BBC349C700E8E78CF981C3B19F189E738E0D546CD45AA4B68F7C
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\83D863F495E7D991917B3ABB3E1EB382_4D9C2C5E642FAF6FA3B8098AB3241EF2binary
MD5:A0D4A4AD8EEFB06BC44C02325A33AFDB
SHA256:13936BBF0D0AF26F871C3C814E5881C9CE9E09E83AB3EEF640ED4C7EA2415CF7
1684Delta V3.61 b_53796675.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
55
TCP/UDP connections
145
DNS requests
175
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1684
Delta V3.61 b_53796675.exe
GET
200
142.251.36.3:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
1684
Delta V3.61 b_53796675.exe
GET
200
142.251.36.3:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
4308
svchost.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1684
Delta V3.61 b_53796675.exe
GET
200
142.251.36.3:80
http://o.pki.goog/s/wr3/fgA/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEH4AzC8CtsuHCuCmoKpV7Vk%3D
unknown
—
—
whitelisted
1684
Delta V3.61 b_53796675.exe
GET
200
142.251.36.3:80
http://o.pki.goog/s/wr3/URM/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEFET1OsgXJOMCsceBPevDRA%3D
unknown
—
—
whitelisted
1684
Delta V3.61 b_53796675.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
unknown
—
—
whitelisted
1684
Delta V3.61 b_53796675.exe
GET
200
18.65.32.231:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
—
—
whitelisted
1684
Delta V3.61 b_53796675.exe
GET
200
18.238.246.206:80
http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAsG7SjIJKGIOV3vwg87c8M%3D
unknown
—
—
unknown
1684
Delta V3.61 b_53796675.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=1&uid=KNTAThqhQqAGiWD1a55555
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4308
svchost.exe
23.200.189.225:80
www.microsoft.com
Moratelindo Internet Exchange Point
ID
whitelisted
4712
MoUsoCoreWorker.exe
23.200.189.225:80
www.microsoft.com
Moratelindo Internet Exchange Point
ID
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4308
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1684
Delta V3.61 b_53796675.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
1684
Delta V3.61 b_53796675.exe
142.251.36.3:80
ocsp.pki.goog
GOOGLE
US
whitelisted
4308
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1684
Delta V3.61 b_53796675.exe
65.9.86.13:443
dpd.securestudies.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 23.200.189.225
whitelisted
www.dlsft.com
  • 35.190.60.70
unknown
ocsp.pki.goog
  • 142.251.36.3
whitelisted
c.pki.goog
  • 142.251.36.3
whitelisted
o.pki.goog
  • 142.251.36.3
whitelisted
dlsft.com
  • 35.190.60.70
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
dpd.securestudies.com
  • 65.9.86.13
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.65.32.231
whitelisted
ocsp.r2m03.amazontrust.com
  • 18.238.246.206
unknown

Threats

PID
Process
Class
Message
6640
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6640
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
6640
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6640
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6640
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
6640
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
Process
Message
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node questions /questions
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Delta V3.61 b_53796675.exe
scanning node question /questions/question
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Delta V3.61 b_53796675.exe