download:

/Exoliner.exe

Full analysis: https://app.any.run/tasks/08f95764-5ba0-4d43-8de2-82d7df373fac
Verdict: Malicious activity
Analysis date: April 13, 2025, 08:56:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
python
pyinstaller
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

F4BBD85893F34204E414F88AE69C5F48

SHA1:

FD4651CEFB810E3344F43C308C8C3C19ECAE51FE

SHA256:

E3C175829525983D448A5D8665D1C714D69A65CFA2A8877B539790E03545A731

SSDEEP:

196608:qghBiCWMG+A7q/T+g6WTyY87Nddg0VSs1p9:rvWJzq/qg6WTyLNddxYS9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Exoliner.exe (PID: 496)

  • SUSPICIOUS

    • Process drops python dynamic module

      • Exoliner.exe (PID: 5256)

    • The process drops C-runtime libraries

      • Exoliner.exe (PID: 5256)

    • Process drops legitimate windows executable

      • Exoliner.exe (PID: 5256)

    • Executable content was dropped or overwritten

      • Exoliner.exe (PID: 5256)
      • Exoliner.exe (PID: 496)

    • Application launched itself

      • Exoliner.exe (PID: 5256)

    • Loads Python modules

      • Exoliner.exe (PID: 496)

    • There is functionality for taking screenshot (YARA)

      • Exoliner.exe (PID: 5256)
      • Exoliner.exe (PID: 496)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Exoliner.exe (PID: 496)

  • INFO

    • Reads the computer name

      • Exoliner.exe (PID: 5256)
      • Exoliner.exe (PID: 496)

    • Checks supported languages

      • Exoliner.exe (PID: 5256)
      • Exoliner.exe (PID: 496)

    • The sample compiled with english language support

      • Exoliner.exe (PID: 5256)

    • Create files in a temporary directory

      • Exoliner.exe (PID: 5256)
      • Exoliner.exe (PID: 496)

    • Creates files or folders in the user directory

      • Exoliner.exe (PID: 496)

    • Checks proxy server information

      • Exoliner.exe (PID: 496)

    • Attempting to use instant messaging service

      • Exoliner.exe (PID: 496)

    • PyInstaller has been detected (YARA)

      • Exoliner.exe (PID: 5256)
      • Exoliner.exe (PID: 496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(496) Exoliner.exe
Discord-Webhook-Tokens (1)1360570945332580383/Wo9WdABpmVsrtDJD1LNZoxn_JA_klsX1IDA1Ddg0YGKKcaFirCH1dW4wWINsxTbPOK2d
Discord-Info-Links
1360570945332580383/Wo9WdABpmVsrtDJD1LNZoxn_JA_klsX1IDA1Ddg0YGKKcaFirCH1dW4wWINsxTbPOK2d
Get Webhook Infohttps://discord.com/api/webhooks/1360570945332580383/Wo9WdABpmVsrtDJD1LNZoxn_JA_klsX1IDA1Ddg0YGKKcaFirCH1dW4wWINsxTbPOK2d
Discord-Responses
type0
content
mentions (0)
mention_roles (0)
attachments
id1360901401785401364
filenamescreenshot.png
size365791
urlhttps://cdn.discordapp.com/attachments/1344701172237209725/1360901401785401364/screenshot.png?ex=67fccdb2&is=67fb7c32&hm=dc51ea2f0f08ce028d3cafb817a30581a8348b567ebf8bb97609e91fdc965947&
proxy_urlhttps://media.discordapp.net/attachments/1344701172237209725/1360901401785401364/screenshot.png?ex=67fccdb2&is=67fb7c32&hm=dc51ea2f0f08ce028d3cafb817a30581a8348b567ebf8bb97609e91fdc965947&
width1280
height720
content_typeimage/png
placeholderXwMJFIp/aXd4h4iUeXjLgA9stw==
placeholder_version1
embeds (0)
timestamp2025-04-13T08:56:18.533000+00:00
edited_timestampnull
flags0
components (0)
id1360901401877942283
channel_id1344701172237209725
author
id1360570945332580383
usernameCaptain Hook
avatarnull
discriminator0000
public_flags0
flags0
bottrue
global_namenull
clannull
primary_guildnull
pinnedfalse
mention_everyonefalse
ttsfalse
webhook_id1360570945332580383
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:13 04:43:13+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 173568
InitializedDataSize: 155648
UninitializedDataSize: -
EntryPoint: 0xce20
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start exoliner.exe exoliner.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Users\admin\AppData\Local\Temp\Exoliner.exe" C:\Users\admin\AppData\Local\Temp\Exoliner.exe
Exoliner.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\exoliner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
ims-api
(PID) Process(496) Exoliner.exe
Discord-Webhook-Tokens (1)1360570945332580383/Wo9WdABpmVsrtDJD1LNZoxn_JA_klsX1IDA1Ddg0YGKKcaFirCH1dW4wWINsxTbPOK2d
Discord-Info-Links
1360570945332580383/Wo9WdABpmVsrtDJD1LNZoxn_JA_klsX1IDA1Ddg0YGKKcaFirCH1dW4wWINsxTbPOK2d
Get Webhook Infohttps://discord.com/api/webhooks/1360570945332580383/Wo9WdABpmVsrtDJD1LNZoxn_JA_klsX1IDA1Ddg0YGKKcaFirCH1dW4wWINsxTbPOK2d
(PID) Process(496) Exoliner.exe
Discord-Responses
type0
content
mentions (0)
mention_roles (0)
attachments
id1360901401785401364
filenamescreenshot.png
size365791
urlhttps://cdn.discordapp.com/attachments/1344701172237209725/1360901401785401364/screenshot.png?ex=67fccdb2&is=67fb7c32&hm=dc51ea2f0f08ce028d3cafb817a30581a8348b567ebf8bb97609e91fdc965947&
proxy_urlhttps://media.discordapp.net/attachments/1344701172237209725/1360901401785401364/screenshot.png?ex=67fccdb2&is=67fb7c32&hm=dc51ea2f0f08ce028d3cafb817a30581a8348b567ebf8bb97609e91fdc965947&
width1280
height720
content_typeimage/png
placeholderXwMJFIp/aXd4h4iUeXjLgA9stw==
placeholder_version1
embeds (0)
timestamp2025-04-13T08:56:18.533000+00:00
edited_timestampnull
flags0
components (0)
id1360901401877942283
channel_id1344701172237209725
author
id1360570945332580383
usernameCaptain Hook
avatarnull
discriminator0000
public_flags0
flags0
bottrue
global_namenull
clannull
primary_guildnull
pinnedfalse
mention_everyonefalse
ttsfalse
webhook_id1360570945332580383
5256"C:\Users\admin\AppData\Local\Temp\Exoliner.exe" C:\Users\admin\AppData\Local\Temp\Exoliner.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\exoliner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5544"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5556C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
484
Read events
483
Write events
1
Delete events
0

Modification events

(PID) Process:(496) Exoliner.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SystemDriver32
Value:
C:\Users\admin\AppData\Roaming\System32Services\winupdater.exe
Executable files
28
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_bz2.pydexecutable
MD5:30F396F8411274F15AC85B14B7B3CD3D
SHA256:CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_decimal.pydexecutable
MD5:7AE94F5A66986CBC1A2B3C65A8D617F3
SHA256:DA8BB3D54BBBA20D8FA6C2FD0A4389AEC80AB6BD490B0ABEF5BD65097CBC0DA4
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_hashlib.pydexecutable
MD5:A25BC2B21B555293554D7F611EAA75EA
SHA256:43ACECDC00DD5F9A19B48FF251106C63C975C732B9A2A7B91714642F76BE074D
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_lzma.pydexecutable
MD5:9E94FAC072A14CA9ED3F20292169E5B2
SHA256:A46189C5BD0302029847FED934F481835CB8D06470EA3D6B97ADA7D325218A9F
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_socket.pydexecutable
MD5:69801D1A0809C52DB984602CA2653541
SHA256:67ACA001D36F2FCE6D88DBF46863F60C0B291395B6777C22B642198F98184BA3
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_queue.pydexecutable
MD5:E1C6FF3C48D1CA755FB8A2BA700243B2
SHA256:0A6ACFD24DFBAA777460C6D003F71AF473D5415607807973A382512F77D075FA
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_wmi.pydexecutable
MD5:827615EEE937880862E2F26548B91E83
SHA256:73B7EE3156EF63D6EB7DF9900EF3D200A276DF61A70D08BD96F5906C39A3AC32
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\VCRUNTIME140_1.dllexecutable
MD5:F8DFA78045620CF8A732E67D1B1EB53D
SHA256:A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\Pythonwin\mfc140u.dllexecutable
MD5:84B82C149B450D3C8E0D06F09A416B5D
SHA256:1EC2A31A1302E720C799BAD2FD90CF3457C6B2A375C4B41FAEFEE1A91D92F3E0
5256Exoliner.exeC:\Users\admin\AppData\Local\Temp\_MEI52562\_ssl.pydexecutable
MD5:90F080C53A2B7E23A5EFD5FD3806F352
SHA256:FA5E6FE9545F83704F78316E27446A0026FBEBB9C0C3C63FAED73A12D89784D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
12
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.41:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6656
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6656
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.41:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
496
Exoliner.exe
162.159.135.232:443
discord.com
CLOUDFLARENET
—
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6656
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6656
SIHClient.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.41
  • 23.216.77.30
  • 23.216.77.22
  • 23.216.77.28
whitelisted
google.com
  • 172.217.23.110
whitelisted
discord.com
  • 162.159.135.232
  • 162.159.137.232
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.138.232
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.136
  • 20.190.160.20
  • 20.190.160.65
  • 20.190.160.4
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
496
Exoliner.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
496
Exoliner.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/Exoliner.exe