We analysed delta a while back and didn't spot any malicious behaviour, so it's probably fine. But your friend is exploiting on android, not windows. Who the fuck is going to use an executor on their main anyway?