File name:

5307e6e80026ce038ec5d185c79aa840.exe

Full analysis: https://app.any.run/tasks/6f5a819b-61be-4c57-9317-670f39e9cfdb
Verdict: Malicious activity
Analysis date: April 28, 2025, 08:55:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
arch-exec
arch-doc
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 15 sections
MD5:

5307E6E80026CE038EC5D185C79AA840

SHA1:

E098694951E00B047D1F262FF9E11142B2742341

SHA256:

054CB1E0B461069397D1FEBD61C464305BA0787920FCE8433E602D73EFADAE42

SSDEEP:

98304:Hsq6VdPIw06jRroLaOh3WuHjPue3/ZSCIBAaXoFmvGqcysFcgIEEpunrVgbKbuUC:2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops python dynamic module

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • Process drops legitimate windows executable

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • Executable content was dropped or overwritten

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • The process drops C-runtime libraries

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

  • INFO

    • Reads the software policy settings

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)
      • slui.exe (PID: 6944)

    • Creates files or folders in the user directory

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • Checks supported languages

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • Reads the machine GUID from the registry

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • Reads the computer name

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • The sample compiled with english language support

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • Attempting to use instant messaging service

      • 5307e6e80026ce038ec5d185c79aa840.exe (PID: 3300)

    • Manual execution by a user

      • OpenWith.exe (PID: 1280)
      • notepad.exe (PID: 6824)
      • OpenWith.exe (PID: 1052)
      • OpenWith.exe (PID: 920)
      • pythonw.exe (PID: 2772)
      • notepad.exe (PID: 736)
      • python.exe (PID: 5756)
      • OpenWith.exe (PID: 7152)
      • OpenWith.exe (PID: 6736)
      • OpenWith.exe (PID: 1096)
      • OpenWith.exe (PID: 5548)
      • OpenWith.exe (PID: 1272)
      • OpenWith.exe (PID: 960)
      • OpenWith.exe (PID: 1312)
      • OpenWith.exe (PID: 5720)
      • OpenWith.exe (PID: 3784)
      • OpenWith.exe (PID: 6828)
      • OpenWith.exe (PID: 2384)
      • OpenWith.exe (PID: 4424)
      • OpenWith.exe (PID: 1388)
      • OpenWith.exe (PID: 6136)
      • OpenWith.exe (PID: 5384)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6824)
      • notepad.exe (PID: 736)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 920)
      • OpenWith.exe (PID: 1280)
      • OpenWith.exe (PID: 6736)
      • OpenWith.exe (PID: 7152)
      • OpenWith.exe (PID: 5548)
      • OpenWith.exe (PID: 2384)
      • OpenWith.exe (PID: 1272)
      • OpenWith.exe (PID: 960)
      • OpenWith.exe (PID: 1096)
      • OpenWith.exe (PID: 1312)
      • OpenWith.exe (PID: 5720)
      • OpenWith.exe (PID: 3784)
      • OpenWith.exe (PID: 6828)
      • OpenWith.exe (PID: 1052)
      • OpenWith.exe (PID: 4424)
      • OpenWith.exe (PID: 5384)
      • OpenWith.exe (PID: 6136)
      • OpenWith.exe (PID: 1388)

    • Python executable

      • pythonw.exe (PID: 2772)
      • python.exe (PID: 5756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 2530304
InitializedDataSize: 252928
UninitializedDataSize: -
EntryPoint: 0x73e60
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
27
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 5307e6e80026ce038ec5d185c79aa840.exe sppextcomobj.exe no specs slui.exe pythonw.exe no specs python.exe no specs conhost.exe no specs notepad.exe no specs openwith.exe no specs openwith.exe no specs notepad.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs slui.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\LICENSE.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
920"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\__init__.pycC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
960"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\READMEC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—python.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\sre_parse.pycC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1096"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\__init__.pycC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1272"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\fetch_macholibC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1280"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\cElementTree.pycC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1312"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\log.pycC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1388"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\__init__.pycC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
13 070
Read events
13 070
Write events
0
Delete events
0

Modification events

No data
Executable files
30
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\_bz2.pydexecutable
MD5:3859239CED9A45399B967EBCE5A6BA23
SHA256:A4DD883257A7ACE84F96BCC6CD59E22D843D0DB080606DEFAE32923FC712C75A
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\winsound.pydexecutable
MD5:1C856FABFF6967DD21ADE8338E15D637
SHA256:63ED931F692B63A8D6D7948BD8EF3B6C678B57C0C0574BF649F783C602B4E7E4
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\_asyncio.pydexecutable
MD5:79F71C92C850B2D0F5E39128A59054F1
SHA256:0237739399DB629FDD94DE209F19AC3C8CD74D48BEBE40AD8EA6AC7556A51980
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\LICENSE.txttext
MD5:EBCF45A479F291A0D965EA60B5F1C30B
SHA256:616FA565945ECA2F0E0A5440B3973FED7D5291622B90849212077FE68E27DCB0
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\select.pydexecutable
MD5:C97A587E19227D03A85E90A04D7937F6
SHA256:C4AA9A106381835CFB5F9BADFB9D77DF74338BC66E69183757A5A3774CCDACCF
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\pyexpat.pydexecutable
MD5:9C21A5540FC572F75901820CF97245EC
SHA256:2FF8CD82E7CC255E219E7734498D2DEA0C65A5AB29DC8581240D40EB81246045
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\vcruntime140_1.dllexecutable
MD5:7E668AB8A78BD0118B94978D154C85BC
SHA256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\python3.dllexecutable
MD5:B711598FC3ED0FE4CF2C7F3E0877979E
SHA256:520169AA6CF49D7EE724D1178DE1BE0E809E4BDCF671E06F3D422A0DD5FD294A
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\python.exeexecutable
MD5:B6EF5717317F6300D663ED9559EE9967
SHA256:4FB049EEDDD221E5470CD33177299DD13F85EBA25BEEF7ACED7A0890AD85181F
33005307e6e80026ce038ec5d185c79aa840.exeC:\Users\admin\AppData\Roaming\Suh\python_portable\pythonw.exeexecutable
MD5:9D0F19A3FDF077FC90CB1055018669FD
SHA256:695EC4080F596F485E4E36DE383A32F18042BC13620CF93BA5708EC354B6CA0D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1812
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1812
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3300
5307e6e80026ce038ec5d185c79aa840.exe
151.101.0.223:443
www.python.org
FASTLY
US
whitelisted
3300
5307e6e80026ce038ec5d185c79aa840.exe
162.159.129.233:443
cdn.discordapp.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.216.77.19
  • 23.216.77.23
  • 23.216.77.21
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
www.python.org
  • 151.101.0.223
  • 151.101.64.223
  • 151.101.128.223
  • 151.101.192.223
whitelisted
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.134.233
  • 162.159.130.233
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 40.126.31.0
  • 20.190.159.2
  • 40.126.31.128
  • 20.190.159.0
  • 20.190.159.130
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3300
5307e6e80026ce038ec5d185c79aa840.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5307e6e80026ce038ec5d185c79aa840.exe