File scan report
Verdict Safe
Is dolphin-
None of the 61 antivirus engines that checked it flagged this widely submitted archive, while one clean sandbox run provided no concrete target for the possible injection mapping.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 18d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 61 antivirus engines that checked it flagged the archive, including the 17 major antivirus engines that reported results, and it has already appeared from 162 sources. One sandbox run mapped possible injection and persistence techniques, but recorded no injected process, persistence indicator, malicious verdict, or sample network contact.
The strongest evidence is the absence of detections across 75 engines, including 17 major antivirus engines reporting no detection. The archive is also broadly distributed, with 162 sources and 173 submissions despite being recently observed. A completed sandbox run returned a clean result and recorded no sample network contacts. The and mappings warrant caution, but no injected process, persistence indicator, or malicious sandbox verdict substantiates them. External intelligence and the extracted-child rollup provide no confirmed malware finding, although ten children lack saved individual verdicts and host-reputation coverage was not completed.
What We Detected
None of the 61 antivirus engines that checked it flagged the 7-Zip archive, and all 17 major antivirus engines that reported results found no detection. The file has appeared from 162 sources across 173 submissions, indicating broad recent distribution. No malware-family label or malware-specific research rule matched it.
Threat Behavior
One completed sandbox run returned a clean result and observed the Dolphin executables, Qt libraries, crash-reporting processes, and related temporary files. It mapped activity to T1055 and T1547.001, but recorded no injected target process, persistence indicator, registry modification, or sample network contact. A separate reputation check of contacted hosts was not available, and ten extracted files lack saved individual verdicts.
What To Do Now
Use the archive only if it came from the expected project or distribution channel, and keep security software enabled while extracting and running it. Recheck the contained executables individually if stronger assurance is required.
Where this verdict could be wrong3 caveats
- The test run mapped activity to and T1547.001, techniques that can be used for injection and registry-run-key persistence, although no injected target or persistence indicator was recorded.
- The archive contains executable files, and all ten extracted children lack saved individual verdicts, leaving incomplete child-level coverage.
- No complete contacted-host reputation result is available, although the observed run recorded no sample network contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 61 antivirus engines that checked it flagged the archive, including 17 major antivirus engines that reported no detection.
- The file has been submitted 173 times from 162 sources, indicating broad recent distribution.
- The completed sandbox run returned a clean result and recorded no sample network contact.
- No malware-specific research rules or known malware-feed matches were found.
- No extracted child has a saved malicious finding.
- The test run mapped possible process injection and registry-run-key persistence techniques without identifying a target or confirmed persistence change.
- The archive contains executable files, and ten extracted components lack saved individual verdicts.
- A complete reputation cross-check for contacted hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 12spawned processes
- 0network contacts
- 36filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1112
- T1129· Loads modules
- T1497· Sandbox evasion
- T1547· Auto-start
- T1547.001· Auto-start
- T1574· Execution hijack
Observed activity
Processes started
12Programs the file ran, with their command lines.
Dolphin.exe"C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\Dolphin.exe"DolphinTool.exe"C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\DolphinTool.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\Qt6Core.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\Qt6Gui.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\Qt6Svg.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\Qt6Widgets.dll",#1
Show all 12 entries for processes started
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\QtPlugins\iconengines\qsvgicon.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\QtPlugins\imageformats\qsvg.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\QtPlugins\platforms\qwindows.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\QtPlugins\styles\qmodernwindowsstyle.dll",#1Updater.exe"C:\Users\<USER>\AppData\Local\Temp\Dolphin-x64\Updater.exe"unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\dolphin-2609a-x64.7z"
Files
30Files the file created, changed or deleted.
- Written
\Device\Psched - Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\02a27454-0039-4bae-b63c-b17fbbc87f22 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\95b47610-a869-4c0c-802d-bcfa266fe27f - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive
Show all 30 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\8fad5251-8098-4d4d-9216-2790b7c218f7 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\e203be06-544a-4b9a-8164-fa7d9059e3f4 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\02f25e66-09c1-469f-84d9-25c9e6a05a26 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\091d8403-6537-41c6-9c75-58d0608b08ae - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF344.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC6D.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER279.tmp.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\1922ed00-70fb-46ba-b8bf-2b38d4b1e696 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\7cc5b7f7-2be1-4c57-a7d6-290a36ea2582 - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF344.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC6D.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER279.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF344.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC6D.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER279.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFA.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D05.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2274.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFA.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D05.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2274.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C0A.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER25BF.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2831.tmp
Mutexes
6Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess4012Global\e3f5d9de-badc-4aaf-bff3-4e5701452a6eLocal\WERReportingForProcess6084Global\8ca6ccd3-b6f8-46f2-8ab0-8c15a04bb734Local\WERReportingForProcess5460Global\3c44da18-e3ef-4547-81f5-3205a4f49360
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4012 -s 608 - VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6084 -s 432 - VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5460 -s 652
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 18b1ed516d0e42b639c7…eb4e4dNot checkedno saved verdict
- 2d922638644a9f83daf3…9caaa9Not checkedno saved verdict
- 948fe9e96c3ffa075fbf…472139Not checkedno saved verdict
- d0e05d578dd6f6fe9f61…be9074Not checkedno saved verdict
- 4a4938279ec5bd40738e…26ae72Not checkedno saved verdict
- c1f09f3fbc8673240af2…bcd4a5Not checkedno saved verdict
- 8c29b04924542185ec31…13c6ccNot checkedno saved verdict
- 0771d54c287cb66b3174…0e0f71Not checkedno saved verdict
- 8915268e0a503446a731…098d26Not checkedno saved verdict
- 4b1b8e4a2752d464ae02…645c8fNot checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 13, 2026, 2:09 AM UTC
- SHA-256
bbfd13bf9e6d2a4164a15c392b1f32a9b18150e5136746b388704608fbb60f76- SHA-1
cbea70dfbce1341255e74c418ba6800124807ae6- MD5
7f4b5963dc234a52c80e4b8af92a4cb0
About this file
dolphin-2609a-x64.7z is a 7ZIP file of 20.0 MB.
- Type and size
- 7ZIP · 20.0 MB
- Signer
- Not applicable
- First seen
- Oct 8, 2026On VirusTotal.
- Submitted by
- 162 distinct sources
First scanned
Antivirus consensus
0 of 61 engines flagged this file
14 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-231 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexNo result
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is dolphin-2609a-x64.7z safe?
What is dolphin-2609a-x64.7z?
How many antivirus engines detected dolphin-2609a-x64.7z?
What is the SHA-256 hash of dolphin-2609a-x64.7z?
Is it safe to open or extract dolphin-2609a-x64.7z?
How up to date is this analysis of dolphin-2609a-x64.7z?
Community
Member reviews and reports for this exact file hash.