URL:

https://delta-executor.com/delta-executor-pc/

Full analysis: https://app.any.run/tasks/83c50f88-4f9e-423e-a4f0-e4eec015b4a3
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 15, 2024, 23:33:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
adware
pua
discord
Indicators:
MD5:

321BE7157781C822423C949D45C92346

SHA1:

032C9048D385B8E5DAAA59A46F8D2B4F923E7E47

SHA256:

F4300122500A1EF88896FB4CEFE69C1AF52757D823491CD5662E80AD15DD8111

SSDEEP:

3:N8YuqRJJi9qRbd:2YuqRJJi9qRbd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)

    • ADWARE has been detected (SURICATA)

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

    • Checks Windows Trust Settings

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 8140)

    • Executable content was dropped or overwritten

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

    • Process drops legitimate windows executable

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

    • Reads security settings of Internet Explorer

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 7748)
      • setup76486102.exe (PID: 8140)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 6976)
      • Delta.exe (PID: 6832)
      • OfferInstaller.exe (PID: 6740)

    • The process drops C-runtime libraries

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

    • Reads the Windows owner or organization settings

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)

    • Executing commands from a ".bat" file

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)

    • Starts CMD.EXE for commands execution

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)

    • Adds/modifies Windows certificates

      • setup76486102.exe (PID: 4540)

    • Access to an unwanted program domain was detected

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

    • Searches for installed software

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

    • The process creates files with name similar to system file names

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7904)
      • cmd.exe (PID: 6804)
      • cmd.exe (PID: 6672)

    • Get information on the list of running processes

      • cmd.exe (PID: 7904)
      • cmd.exe (PID: 6804)
      • cmd.exe (PID: 6672)

    • Reads the date of Windows installation

      • setup76486102.exe (PID: 8140)
      • Delta V3.61 b_76486102.exe (PID: 8072)

    • Start notepad (likely ransomware note)

      • Delta V3.61 b_76486102.exe (PID: 8072)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 6532)
      • firefox.exe (PID: 7636)
      • firefox.exe (PID: 5992)
      • msedge.exe (PID: 5408)
      • msedge.exe (PID: 7064)

    • Checks supported languages

      • TextInputHost.exe (PID: 7216)
      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 7748)
      • setup76486102.exe (PID: 8140)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 6976)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)
      • identity_helper.exe (PID: 3904)

    • The process uses the downloaded file

      • chrome.exe (PID: 5540)
      • chrome.exe (PID: 6532)
      • WinRAR.exe (PID: 2608)
      • firefox.exe (PID: 5992)

    • Checks proxy server information

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 6532)
      • firefox.exe (PID: 5992)
      • msedge.exe (PID: 5408)
      • Delta.exe (PID: 6832)
      • msedge.exe (PID: 7064)

    • Creates files or folders in the user directory

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)

    • Reads the machine GUID from the registry

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 7748)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 8140)
      • setup76486102.exe (PID: 6976)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6532)
      • WinRAR.exe (PID: 2608)
      • firefox.exe (PID: 5992)

    • Reads the computer name

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • TextInputHost.exe (PID: 7216)
      • setup76486102.exe (PID: 7748)
      • setup76486102.exe (PID: 8140)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 6976)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)
      • identity_helper.exe (PID: 3904)

    • Reads the software policy settings

      • Delta V3.61 b_76486102.exe (PID: 3376)
      • setup76486102.exe (PID: 4540)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • setup76486102.exe (PID: 8140)
      • Delta.exe (PID: 6832)

    • Create files in a temporary directory

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 7748)
      • setup76486102.exe (PID: 8140)
      • setup76486102.exe (PID: 6976)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)

    • Disables trace logs

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)

    • Reads Environment values

      • setup76486102.exe (PID: 4540)
      • setup76486102.exe (PID: 8140)
      • OfferInstaller.exe (PID: 6740)
      • Delta.exe (PID: 6832)
      • identity_helper.exe (PID: 3904)

    • Manual execution by a user

      • Delta V3.61 b_76486102.exe (PID: 6900)
      • Delta V3.61 b_76486102.exe (PID: 8072)
      • WinRAR.exe (PID: 2608)
      • Delta.exe (PID: 6832)
      • firefox.exe (PID: 7636)

    • Process checks computer location settings

      • setup76486102.exe (PID: 8140)
      • Delta V3.61 b_76486102.exe (PID: 8072)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7756)

    • Attempting to use instant messaging service

      • msedge.exe (PID: 7828)
      • Delta.exe (PID: 6832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
251
Monitored processes
108
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs textinputhost.exe no specs chrome.exe no specs chrome.exe no specs delta v3.61 b_76486102.exe no specs delta v3.61 b_76486102.exe #ADWARE setup76486102.exe setup76486102.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs rundll32.exe no specs delta v3.61 b_76486102.exe no specs delta v3.61 b_76486102.exe #ADWARE setup76486102.exe setup76486102.exe no specs offerinstaller.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe delta.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1060"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6088 --field-trial-handle=1876,i,2092058738519063485,639713692226772321,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1128timeout 5C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1224"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5180 --field-trial-handle=2328,i,2045525942624439379,10036268417426820912,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1248"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3548 --field-trial-handle=2328,i,2045525942624439379,10036268417426820912,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
1420"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5316 --field-trial-handle=2328,i,2045525942624439379,10036268417426820912,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1488"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2492 --field-trial-handle=2328,i,2045525942624439379,10036268417426820912,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1680"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2324,i,14384227989755939629,6645227511867854757,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1860find /I "6740"C:\Windows\SysWOW64\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\find.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2608"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Delta V3.61.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3400 --field-trial-handle=2324,i,14384227989755939629,6645227511867854757,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
68 678
Read events
68 255
Write events
413
Delete events
10

Modification events

(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(6532) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6532) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
57
Suspicious files
520
Text files
231
Unknown types
14

Dropped files

PID
Process
Filename
Type
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RFe608a.TMP —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RFe60aa.TMP —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RFe61b3.TMPtext
MD5:390E3C6EDCE7036BB6F52670DC24ABAD
SHA256:D6F1B47CD05A8E1FAD989DEEC22ED67EA9A013C2DE0CCAFD68A539F69BD0DD70
6532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:19D1A06251A8678F85D8DE5BFAB83807
SHA256:AA6E55DCF84CDAF0BD3F913E7B837F65500E9B71A5A7AA773D02FFBC18C7FF01
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
67
TCP/UDP connections
225
DNS requests
291
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5992
firefox.exe
POST
200
184.24.77.48:80
http://r11.o.lencr.org/
unknown
—
—
unknown
6140
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5248
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6412
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3376
Delta V3.61 b_76486102.exe
GET
200
172.217.23.99:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
3376
Delta V3.61 b_76486102.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
6140
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4540
setup76486102.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
—
—
whitelisted
3376
Delta V3.61 b_76486102.exe
GET
200
172.217.23.99:80
http://o.pki.goog/s/wr3/PIM/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEDyDcTv8LUs2EpYkQxGX%2BBE%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1984
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1164
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6532
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
6816
chrome.exe
188.114.96.9:443
delta-executor.com
CLOUDFLARENET
NL
unknown
6816
chrome.exe
173.194.79.84:443
accounts.google.com
GOOGLE
US
unknown
6816
chrome.exe
169.150.247.38:443
images.dmca.com
—
GB
unknown
6816
chrome.exe
77.37.53.207:443
magictag.digislots.in
diva-e Datacenters GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.181.238
whitelisted
delta-executor.com
  • 188.114.96.9
  • 188.114.97.9
unknown
accounts.google.com
  • 173.194.79.84
whitelisted
images.dmca.com
  • 169.150.247.38
whitelisted
stats.wp.com
  • 192.0.76.3
whitelisted
magictag.digislots.in
  • 77.37.53.207
unknown
pagead2.googlesyndication.com
  • 142.250.181.226
whitelisted
fundingchoicesmessages.google.com
  • 142.250.185.78
whitelisted
securepubads.g.doubleclick.net
  • 142.250.185.66
whitelisted

Threats

PID
Process
Class
Message
6816
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
6816
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7828
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
7828
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
7828
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
2256
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
6832
Delta.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
6832
Delta.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
6 ETPRO signatures available at the full report
Process
Message
Delta V3.61 b_76486102.exe
Error: (undefined) has no property - value
Delta V3.61 b_76486102.exe
at initializeDynamicVariables (this://app/main.html(329))
Delta V3.61 b_76486102.exe
at getFileInfo.@285@39 (this://app/main.html(307))
Delta V3.61 b_76486102.exe
Delta V3.61 b_76486102.exe
setup76486102.exe
Error: File not found - sciterwrapper:console.tis
setup76486102.exe
at sciter:init-script.tis
setup76486102.exe
setup76486102.exe
setup76486102.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://delta-executor.com/delta-executor-pc/