File name:

Delta V3.61 b_76383676.exe

Full analysis: https://app.any.run/tasks/e77580c7-b05e-4805-96c5-5fe913eee956
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 15, 2024, 23:19:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pua
adware
stealer
discord
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3D50042E3E3991BE509F56A2951A2183

SHA1:

F027790AFE9D7CE2DDF17973F0778FB9E983DED1

SHA256:

76EEE256F1223082E8396611BACA498542C656EDD0FAC5FE903E06E6CB5677E2

SSDEEP:

98304:Q35eb5aF+iBqNxZ/u7IsWlWOyEvVIjvhExD14+GHkPAH3m3U0o1hYffgB/L6c5Mh:KmhiB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)

    • ADWARE has been detected (SURICATA)

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)

    • Scans artifacts that could help determine the target

      • Delta V3.61 b_76383676.exe (PID: 6472)

    • Registers / Runs the DLL via REGSVR32.EXE

      • idfo1fpc.cmi.exe (PID: 6584)

    • Changes the autorun value in the registry

      • opera.exe (PID: 6300)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup.exe (PID: 3916)
      • OperaGX.exe (PID: 5084)
      • setup.exe (PID: 5468)
      • setup.exe (PID: 2876)
      • setup.exe (PID: 7108)
      • setup.exe (PID: 3900)
      • setup76383676.exe (PID: 5400)
      • idfo1fpc.cmi.exe (PID: 6584)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5992)
      • installer.exe (PID: 8680)
      • installer.exe (PID: 9068)

    • Reads security settings of Internet Explorer

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 6944)
      • setup.exe (PID: 3916)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)
      • setup76383676.exe (PID: 1784)
      • OfferInstaller.exe (PID: 6772)
      • Delta.exe (PID: 7576)
      • idfo1fpc.cmi.exe (PID: 6584)
      • installer.exe (PID: 8680)

    • Checks Windows Trust Settings

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup.exe (PID: 3916)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)

    • Executable content was dropped or overwritten

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup.exe (PID: 3916)
      • OperaGX.exe (PID: 5084)
      • setup.exe (PID: 5468)
      • setup.exe (PID: 2876)
      • setup.exe (PID: 7108)
      • setup76383676.exe (PID: 5400)
      • setup.exe (PID: 3900)
      • idfo1fpc.cmi.exe (PID: 6584)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5992)
      • installer.exe (PID: 8680)
      • installer.exe (PID: 9068)

    • The process creates files with name similar to system file names

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)

    • Process drops legitimate windows executable

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)

    • The process drops C-runtime libraries

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)

    • Reads the Windows owner or organization settings

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)

    • Adds/modifies Windows certificates

      • setup76383676.exe (PID: 6560)

    • Searches for installed software

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)
      • installer.exe (PID: 8680)

    • Executing commands from a ".bat" file

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)

    • Access to an unwanted program domain was detected

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)

    • Starts CMD.EXE for commands execution

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)

    • Get information on the list of running processes

      • cmd.exe (PID: 2180)
      • cmd.exe (PID: 1360)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2180)
      • cmd.exe (PID: 1360)

    • Application launched itself

      • setup.exe (PID: 3916)
      • setup.exe (PID: 7108)
      • assistant_installer.exe (PID: 4704)
      • installer.exe (PID: 8680)
      • opera.exe (PID: 6300)

    • Starts itself from another location

      • setup.exe (PID: 3916)

    • Reads the date of Windows installation

      • setup76383676.exe (PID: 5400)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • installer.exe (PID: 8680)

    • Drops 7-zip archiver for unpacking

      • idfo1fpc.cmi.exe (PID: 6584)

    • Start notepad (likely ransomware note)

      • Delta V3.61 b_76383676.exe (PID: 6736)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 8428)

    • Starts SC.EXE for service management

      • idfo1fpc.cmi.exe (PID: 6584)

    • Creates a software uninstall entry

      • idfo1fpc.cmi.exe (PID: 6584)
      • installer.exe (PID: 8680)

  • INFO

    • Checks supported languages

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 6944)
      • OperaGX.exe (PID: 5084)
      • setup.exe (PID: 3916)
      • setup.exe (PID: 5468)
      • setup.exe (PID: 2876)
      • setup.exe (PID: 7108)
      • setup.exe (PID: 3900)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)
      • setup76383676.exe (PID: 1784)
      • OfferInstaller.exe (PID: 6772)
      • idfo1fpc.cmi.exe (PID: 6584)
      • TextInputHost.exe (PID: 6484)
      • Delta.exe (PID: 7576)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5992)
      • assistant_installer.exe (PID: 4704)
      • EsgInstallerDelay__1.exe (PID: 8612)
      • EsgInstallerDelay__0.exe (PID: 8488)
      • identity_helper.exe (PID: 9100)
      • identity_helper.exe (PID: 8936)
      • assistant_installer.exe (PID: 6524)
      • installer.exe (PID: 8680)
      • installer.exe (PID: 9068)
      • opera.exe (PID: 8780)
      • opera.exe (PID: 6300)
      • opera_crashreporter.exe (PID: 9132)
      • opera.exe (PID: 3180)
      • opera.exe (PID: 8244)
      • opera.exe (PID: 7232)
      • opera.exe (PID: 5484)
      • opera_crashreporter.exe (PID: 8048)
      • opera.exe (PID: 2088)
      • opera_gx_splash.exe (PID: 4436)
      • opera.exe (PID: 6940)
      • opera.exe (PID: 2608)
      • opera.exe (PID: 8180)
      • opera.exe (PID: 3164)
      • opera.exe (PID: 8028)
      • opera.exe (PID: 8988)
      • opera.exe (PID: 8140)
      • opera.exe (PID: 7396)
      • opera.exe (PID: 7536)
      • opera.exe (PID: 6776)
      • opera.exe (PID: 304)

    • Reads the computer name

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 6944)
      • setup.exe (PID: 3916)
      • setup.exe (PID: 7108)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)
      • setup76383676.exe (PID: 1784)
      • OfferInstaller.exe (PID: 6772)
      • idfo1fpc.cmi.exe (PID: 6584)
      • TextInputHost.exe (PID: 6484)
      • Delta.exe (PID: 7576)
      • assistant_installer.exe (PID: 4704)
      • identity_helper.exe (PID: 9100)
      • identity_helper.exe (PID: 8936)
      • installer.exe (PID: 8680)
      • opera.exe (PID: 6300)
      • opera.exe (PID: 3180)
      • opera.exe (PID: 8244)
      • opera.exe (PID: 8780)
      • opera_gx_splash.exe (PID: 4436)

    • Creates files or folders in the user directory

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup.exe (PID: 5468)
      • setup.exe (PID: 3916)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)
      • Delta.exe (PID: 7576)
      • setup.exe (PID: 7108)
      • installer.exe (PID: 8680)
      • opera.exe (PID: 6300)

    • Reads the machine GUID from the registry

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 6944)
      • setup.exe (PID: 3916)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)
      • setup76383676.exe (PID: 1784)
      • Delta.exe (PID: 7576)
      • opera.exe (PID: 6300)

    • Checks proxy server information

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup.exe (PID: 3916)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)
      • Delta.exe (PID: 7576)
      • opera.exe (PID: 6300)

    • Create files in a temporary directory

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 6944)
      • setup.exe (PID: 3916)
      • OperaGX.exe (PID: 5084)
      • setup.exe (PID: 5468)
      • setup.exe (PID: 2876)
      • setup.exe (PID: 7108)
      • setup.exe (PID: 3900)
      • setup76383676.exe (PID: 5400)
      • setup76383676.exe (PID: 1784)
      • OfferInstaller.exe (PID: 6772)
      • idfo1fpc.cmi.exe (PID: 6584)
      • Delta.exe (PID: 7576)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5992)
      • installer.exe (PID: 8680)
      • installer.exe (PID: 9068)
      • opera.exe (PID: 6300)

    • Reads the software policy settings

      • Delta V3.61 b_76383676.exe (PID: 6472)
      • setup76383676.exe (PID: 6560)
      • setup.exe (PID: 3916)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)
      • Delta.exe (PID: 7576)

    • Reads Environment values

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)
      • Delta.exe (PID: 7576)
      • identity_helper.exe (PID: 9100)
      • identity_helper.exe (PID: 8936)

    • Disables trace logs

      • setup76383676.exe (PID: 6560)
      • setup76383676.exe (PID: 5400)
      • OfferInstaller.exe (PID: 6772)
      • Delta.exe (PID: 7576)

    • Manual execution by a user

      • Delta V3.61 b_76383676.exe (PID: 6568)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • firefox.exe (PID: 6848)
      • WinRAR.exe (PID: 7052)
      • Delta.exe (PID: 7576)
      • opera.exe (PID: 6300)

    • Process checks computer location settings

      • setup76383676.exe (PID: 5400)
      • Delta V3.61 b_76383676.exe (PID: 6736)
      • opera.exe (PID: 6300)
      • opera.exe (PID: 2608)
      • opera.exe (PID: 2088)
      • opera.exe (PID: 6940)
      • opera.exe (PID: 304)

    • Creates files in the program directory

      • idfo1fpc.cmi.exe (PID: 6584)

    • Application launched itself

      • firefox.exe (PID: 6848)
      • firefox.exe (PID: 3360)
      • msedge.exe (PID: 7200)
      • msedge.exe (PID: 8720)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7052)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 3360)
      • msedge.exe (PID: 7200)
      • Delta.exe (PID: 7576)
      • idfo1fpc.cmi.exe (PID: 6584)
      • msedge.exe (PID: 8720)

    • The process uses the downloaded file

      • firefox.exe (PID: 3360)
      • WinRAR.exe (PID: 7052)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6580)

    • Attempting to use instant messaging service

      • msedge.exe (PID: 6412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:15 13:24:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4351488
InitializedDataSize: 5655040
UninitializedDataSize: -
EntryPoint: 0x398917
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
271
Monitored processes
133
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start delta v3.61 b_76383676.exe #ADWARE setup76383676.exe setup76383676.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs operagx.exe setup.exe setup.exe setup.exe setup.exe setup.exe delta v3.61 b_76383676.exe no specs delta v3.61 b_76383676.exe #ADWARE setup76383676.exe setup76383676.exe no specs offerinstaller.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs idfo1fpc.cmi.exe notepad.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe rundll32.exe no specs delta.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe assistant_installer.exe assistant_installer.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sc.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs regsvr32.exe no specs esginstallerdelay__0.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs conhost.exe no specs esginstallerdelay__1.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs installer.exe installer.exe opera.exe no specs opera_crashreporter.exe no specs opera.exe opera_crashreporter.exe no specs opera.exe no specs opera.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera_gx_splash.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs delta v3.61 b_76383676.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 OPR/112.0.0.0 (Edition std-2)" --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:amazon-new-ids=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:gx-wallpaper-takeover-2-animation=on --with-feature:lucid-mode-hide-text=on --with-feature:panic-button=on --with-feature:password-generator=off --with-feature:play-again=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GXCTest50-ref:DNA-99214_GXCTest50 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4768,i,5831134986567837020,8216612317609551691,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Version:
112.0.5197.60
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\112.0.5197.60\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
400"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2276 -parentBuildID 20240213221259 -prefsHandle 2268 -prefMapHandle 2256 -prefsLen 30537 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5fb93b6-6862-48be-bd9c-d0e17b661f5e} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" 1a870b80910 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
872find /I "6560"C:\Windows\SysWOW64\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\find.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=2316,i,6115208603733473262,15566083720586808043,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1360C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\H2OCleanup.bat""C:\Windows\SysWOW64\cmd.exe—setup76383676.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1784C:\Users\admin\AppData\Local\setup76383676.exe hreadyC:\Users\admin\AppData\Local\setup76383676.exe—Delta V3.61 b_76383676.exe
User:
admin
Company:
DT001
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\setup76383676.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2088"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 OPR/112.0.0.0 (Edition std-2)" --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:amazon-new-ids=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:gx-wallpaper-takeover-2-animation=on --with-feature:lucid-mode-hide-text=on --with-feature:panic-button=on --with-feature:password-generator=off --with-feature:play-again=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GXCTest50-ref:DNA-99214_GXCTest50 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3572,i,5831134986567837020,8216612317609551691,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Version:
112.0.5197.60
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\112.0.5197.60\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
2180C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\H2OCleanup.bat""C:\Windows\SysWOW64\cmd.exe—setup76383676.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2608"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 OPR/112.0.0.0 (Edition std-2)" --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:amazon-new-ids=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:gx-wallpaper-takeover-2-animation=on --with-feature:lucid-mode-hide-text=on --with-feature:panic-button=on --with-feature:password-generator=off --with-feature:play-again=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GXCTest50-ref:DNA-99214_GXCTest50 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4144,i,5831134986567837020,8216612317609551691,262144 --disable-features=CertificateTransparencyAskBeforeEnabling --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Version:
112.0.5197.60
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\112.0.5197.60\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
2876"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --versionC:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Installer
Exit code:
0
Version:
112.0.5197.60
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera gx installer temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
158 580
Read events
158 029
Write events
537
Delete events
14

Modification events

(PID) Process:(6472) Delta V3.61 b_76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6472) Delta V3.61 b_76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6472) Delta V3.61 b_76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6472) Delta V3.61 b_76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6472) Delta V3.61 b_76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6472) Delta V3.61 b_76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6472) Delta V3.61 b_76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6560) setup76383676.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll
(PID) Process:(6560) setup76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6560) setup76383676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
86
Suspicious files
468
Text files
201
Unknown types
16

Dropped files

PID
Process
Filename
Type
6472Delta V3.61 b_76383676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199der
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
6472Delta V3.61 b_76383676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7AC808F2E889734EBC6F689B70B91F12_618D34F351E24C6C0410CC0C828FF379der
MD5:97546AD783886B39587061847C2C1C26
SHA256:6898958DF1E1DF9BE7A01B90B7235B700279FCEA416770A78958A9CB490CFED7
6560setup76383676.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dllexecutable
MD5:8FF1898897F3F4391803C7253366A87B
SHA256:51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
6472Delta V3.61 b_76383676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:CF7809ED4B0AA16624D01949CFC0711E
SHA256:96845CA48B7DB940D7633B12494CB6784926EEF8AE8BF5B571E86FA8AEC0325B
6560setup76383676.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dllexecutable
MD5:6E001F8D0EE4F09A6673A9E8168836B6
SHA256:6A30F9C604C4012D1D2E1BA075213C378AFB1BFCB94276DE7995ED7BBF492859
6472Delta V3.61 b_76383676.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\geo[1].htmtext
MD5:945F34F14D1BA0808BB9AE57F042BEDB
SHA256:CC7DF7F6538F5C1B7D5BCBDFB79DFA3C26548DD34C0CA17048F00A546BABF71E
6472Delta V3.61 b_76383676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7AC808F2E889734EBC6F689B70B91F12_618D34F351E24C6C0410CC0C828FF379binary
MD5:1BFB14166BFDF90709A57F7EB8742004
SHA256:D568779F9F16A1FC39938DC0813618EDE0D1E2217B77D99F1741E7B899A55748
6472Delta V3.61 b_76383676.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\service[1].htmtext
MD5:F9D4655BBB31D3745D1D1671E3A09F4A
SHA256:C09DC2BA6150D341E056631E8FBC1A91AFCD6D87759BDE08E75A1FC506641203
6560setup76383676.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dllexecutable
MD5:08112F27DCD8F1D779231A7A3E944CB1
SHA256:11C6A8470A3F2B2BE9B8CAFE5F9A0AFCE7303BFD02AB783A0F0EE09A184649FA
6472Delta V3.61 b_76383676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:80F81EF7AE23E6621C7CD7A0F46365E1
SHA256:62C41D936177CD9EAF786256414E67293B4BE5C52773B6F6D82BDB76812D195D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
303
DNS requests
285
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
setup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAfyOr5A1UWlCmQhXhy%2Bwwk%3D
unknown
—
—
whitelisted
6472
Delta V3.61 b_76383676.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
6472
Delta V3.61 b_76383676.exe
GET
200
142.250.186.163:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
6472
Delta V3.61 b_76383676.exe
GET
200
172.217.23.99:80
http://o.pki.goog/s/wr3/PIM/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEDyDcTv8LUs2EpYkQxGX%2BBE%3D
unknown
—
—
whitelisted
6560
setup76383676.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
—
—
whitelisted
6560
setup76383676.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
—
—
whitelisted
6560
setup76383676.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCEBh0NsmIOct9rTne%2FAjdFO0%3D
unknown
—
—
whitelisted
6472
Delta V3.61 b_76383676.exe
GET
200
172.217.23.99:80
http://o.pki.goog/s/wr3/FFw/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEBRcyKmNl5rMCl5QAsUMjJ8%3D
unknown
—
—
whitelisted
6472
Delta V3.61 b_76383676.exe
GET
200
142.250.186.163:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6472
Delta V3.61 b_76383676.exe
GET
200
142.250.186.163:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5116
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6080
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
6472
Delta V3.61 b_76383676.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
6472
Delta V3.61 b_76383676.exe
172.217.23.99:80
ocsp.pki.goog
GOOGLE
US
whitelisted
6472
Delta V3.61 b_76383676.exe
142.250.186.163:80
c.pki.goog
GOOGLE
US
whitelisted
6560
setup76383676.exe
69.192.162.201:80
ocsp.entrust.net
AKAMAI-AS
DE
unknown
6472
Delta V3.61 b_76383676.exe
188.114.96.3:443
filedm.com
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.dlsft.com
  • 35.190.60.70
unknown
ocsp.pki.goog
  • 172.217.23.99
whitelisted
c.pki.goog
  • 142.250.186.163
whitelisted
o.pki.goog
  • 172.217.23.99
whitelisted
ocsp.entrust.net
  • 69.192.162.201
whitelisted
dlsft.com
  • 35.190.60.70
unknown
filedm.com
  • 188.114.96.3
  • 188.114.97.3
malicious
www.google.com
  • 142.250.186.164
whitelisted

Threats

PID
Process
Class
Message
6412
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6412
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6412
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6412
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6412
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6 ETPRO signatures available at the full report
Process
Message
Delta V3.61 b_76383676.exe
Error: (undefined) has no property - value
Delta V3.61 b_76383676.exe
at initializeDynamicVariables (this://app/main.html(329))
Delta V3.61 b_76383676.exe
at getFileInfo.@285@39 (this://app/main.html(307))
Delta V3.61 b_76383676.exe
Delta V3.61 b_76383676.exe
setup76383676.exe
Error: File not found - sciterwrapper:console.tis
setup76383676.exe
at sciter:init-script.tis
setup76383676.exe
setup76383676.exe
setup76383676.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Delta V3.61 b_76383676.exe