File name:

VirusShare_3657c00f80646bea2443ad89dabb25bb

Full analysis: https://app.any.run/tasks/da710996-24ec-40a0-9345-c50c99278e1e
Verdict: Malicious activity
Analysis date: April 19, 2025, 11:44:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

3657C00F80646BEA2443AD89DABB25BB

SHA1:

FD825D9073B149A90D853C810187FB13F4366415

SHA256:

6AAA55ECEE63D3EA9E5C61F829BF3C11043581975EDA30F52621ED0232FD4DE4

SSDEEP:

49152:KmvXBoBmGLoLoyVpTgw3VZQNnLV3mdaMfyUqb:VGBDLbOVgwlmlV3mdaOE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)

  • SUSPICIOUS

    • Starts itself from another location

      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)
      • FileCoAuth.exe (PID: 6112)

    • Starts a Microsoft application from unusual location

      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)
      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 3096)

    • Executable content was dropped or overwritten

      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)
      • Isass.exe (PID: 2100)
      • Isass.exe (PID: 4880)

    • Likely accesses (executes) a file from the Public directory

      • Isass.exe (PID: 4880)
      • Isass.exe (PID: 2100)
      • Isass.exe (PID: 2692)

    • Reads security settings of Internet Explorer

      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)
      • Isass.exe (PID: 2100)
      • FileCoAuth.exe (PID: 6112)
      • Isass.exe (PID: 2692)

    • There is functionality for taking screenshot (YARA)

      • Isass.exe (PID: 4880)

  • INFO

    • Reads the computer name

      • Isass.exe (PID: 4880)
      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)
      • Isass.exe (PID: 2100)
      • Isass.exe (PID: 2692)

    • Checks supported languages

      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)
      • Isass.exe (PID: 4880)
      • Isass.exe (PID: 2100)
      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 3096)
      • Isass.exe (PID: 2692)

    • Process checks computer location settings

      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 2284)
      • Isass.exe (PID: 2100)
      • FileCoAuth.exe (PID: 6112)
      • Isass.exe (PID: 2692)

    • Create files in a temporary directory

      • Isass.exe (PID: 2100)
      • VirusShare_3657c00f80646bea2443ad89dabb25bb.exe (PID: 3096)
      • Isass.exe (PID: 4880)

    • Compiled with Borland Delphi (YARA)

      • Isass.exe (PID: 4880)

    • Checks proxy server information

      • slui.exe (PID: 6808)

    • Reads the software policy settings

      • slui.exe (PID: 1812)
      • slui.exe (PID: 6808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (71.5)
.dll | Win32 Dynamic Link Library (generic) (10.9)
.exe | Win32 Executable (generic) (7.4)
.exe | Win16/32 Executable Delphi generic (3.4)
.exe | Generic Win/DOS Executable (3.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 439296
InitializedDataSize: 132608
UninitializedDataSize: -
EntryPoint: 0x6c1ac
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start virusshare_3657c00f80646bea2443ad89dabb25bb.exe isass.exe isass.exe virusshare_3657c00f80646bea2443ad89dabb25bb.exe no specs sppextcomobj.exe no specs slui.exe filecoauth.exe no specs isass.exe no specs filecoauth.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1812"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2100"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\admin\AppData\Local\Temp\VirusShare_3657c00f80646bea2443ad89dabb25bb.exe C:\Users\Public\Microsoft Build\Isass.exe
VirusShare_3657c00f80646bea2443ad89dabb25bb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\microsoft build\isass.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2284"C:\Users\admin\AppData\Local\Temp\VirusShare_3657c00f80646bea2443ad89dabb25bb.exe" C:\Users\admin\AppData\Local\Temp\VirusShare_3657c00f80646bea2443ad89dabb25bb.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Application Error Reporting
Exit code:
0
Version:
12.0.4518.1014
Modules
Images
c:\users\admin\appdata\local\temp\virusshare_3657c00f80646bea2443ad89dabb25bb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2504C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2692"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -Embedding C:\Users\Public\Microsoft Build\Isass.exe—FileCoAuth.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\microsoft build\isass.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3096"C:\Users\admin\AppData\Local\Temp\VirusShare_3657c00f80646bea2443ad89dabb25bb.exe" C:\Users\admin\AppData\Local\Temp\VirusShare_3657c00f80646bea2443ad89dabb25bb.exe—Isass.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Application Error Reporting
Exit code:
1
Version:
12.0.4518.1014
Modules
Images
c:\users\admin\appdata\local\temp\virusshare_3657c00f80646bea2443ad89dabb25bb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3132"C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe" -Embedding C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—Isass.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4880"C:\Users\Public\Microsoft Build\Isass.exe"C:\Users\Public\Microsoft Build\Isass.exe
VirusShare_3657c00f80646bea2443ad89dabb25bb.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\public\microsoft build\isass.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6112C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6808C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 714
Read events
2 712
Write events
2
Delete events
0

Modification events

(PID) Process:(2284) VirusShare_3657c00f80646bea2443ad89dabb25bb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Isass.exe
Value:
C:\Users\Public\Microsoft Build\Isass.exe
(PID) Process:(2284) VirusShare_3657c00f80646bea2443ad89dabb25bb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Isass.exe
Value:
C:\Users\Public\Microsoft Build\Isass.exe
Executable files
9
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2100Isass.exeC:\Users\admin\AppData\Local\Temp\VirusShare_3657c00f80646bea2443ad89dabb25bb.exeexecutable
MD5:C6D0721E9156EB2A40A04BB38BE0B2A5
SHA256:9BE75731014724A5FD16500FF3AA00A2C7FB89A0A71383A70497EA5A023626FE
4880Isass.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exeexecutable
MD5:02F9044D5E948C8D921CF8680292E143
SHA256:25EB99A94636D70892CA49498431590332FA66032CFF6EBEE8B633432E9631CE
3096VirusShare_3657c00f80646bea2443ad89dabb25bb.exeC:\Users\admin\AppData\Local\Temp\dw.logtext
MD5:418747C2175F003E0A93D70117FB98D3
SHA256:942E66C9A0766B19D66F4E5616039AD59F8B9BB7464AE86FAAD5124DD4288746
3132FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-04-19.1145.3132.1.odlbinary
MD5:39378024EB203EC83AEA9D3C0097F94D
SHA256:DE961D43E6B879847B94266B2A85198BC6F3D51A366A51B3836492B75B87F9B8
3132FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-04-19.1145.3132.1.aodlbinary
MD5:28DCA2FF4B34B5A52A2E59DF202A6ED3
SHA256:33BACCB7296F1ED1F995FC77A23049F261CF391AC0388F9E8DD161F8C17B7F94
2284VirusShare_3657c00f80646bea2443ad89dabb25bb.exeC:\Users\Public\Microsoft Build\Isass.exeexecutable
MD5:666E8D1D1734F1771ABBC8893761EC6D
SHA256:075936FFCDC9C3D257268484CDE84B9ABFD4289A56C2DF19F77289996DDDD4C5
4880Isass.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileSyncHelper.exeexecutable
MD5:81A75614826746FA2349C562E6837CE9
SHA256:A9BC85794F309A6E20B61F5CAEFFC3F1BA23D54F151482A9ABB454CDAD7B8CC6
4880Isass.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\OneDriveUpdaterService.exeexecutable
MD5:59A23C8955DB2623FCB679EF177732A7
SHA256:3FFD4E0B45C05436AA55FA225B3F88389B8FC46773EC15AADAD8D4C6824C6195
4880Isass.exeC:\Users\admin\AppData\Local\Temp\PIXBZimage
MD5:129B269E67B778BD545A9E7C7880A6A5
SHA256:2FE44A067AB974883EFF2C12D5B0935EC1D4FFEBA631AEC7CCDE6D82FE63C4F9
4880Isass.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:53C195A6E5C4DD3CE68E20A8730C4991
SHA256:A83BFCFF94EFF5798626F3C8524DA97595EF00571D44956F3C243B43CA6385BB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
21
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1196
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1196
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1196
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1196
SIHClient.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1196
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1812
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 172.217.18.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.3
  • 20.190.160.17
  • 20.190.160.4
  • 20.190.160.67
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.128
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VirusShare_3657c00f80646bea2443ad89dabb25bb