File name:

Client-built.exe

Full analysis: https://app.any.run/tasks/ae575265-11b4-4ee7-83e2-36fa5de9a451
Verdict: Malicious activity
Analysis date: October 03, 2025, 16:51:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

919D1A18BBA310BD0D451CE41A8FA5CB

SHA1:

16175F716A6EFBC75FF66AFBE0183BD28F2272A3

SHA256:

AEAC308D2F6A25DA39DABACC4111F924834CBAF609998BEB7922147988B48B67

SSDEEP:

49152:hjlqSa3bXnax3jfRACqrg+owpFkC7ZBI5NLEVK5jWEmC9fDwv1Zr0i5Gnq2TKh5o:PZa3bXna9pOrCKZBIYwB9fDOCWh5Y4wA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Client-built.exe (PID: 5836)
      • Update.exe (PID: 5096)

  • SUSPICIOUS

    • Found regular expressions for crypto-addresses (YARA)

      • Update.exe (PID: 5096)

    • There is functionality for taking screenshot (YARA)

      • Update.exe (PID: 5096)

    • Executable content was dropped or overwritten

      • Client-built.exe (PID: 5836)

    • Starts itself from another location

      • Client-built.exe (PID: 5836)

  • INFO

    • Creates files or folders in the user directory

      • Client-built.exe (PID: 5836)

    • Reads the computer name

      • Client-built.exe (PID: 5836)
      • Update.exe (PID: 3848)
      • Update.exe (PID: 5096)

    • Checks supported languages

      • Client-built.exe (PID: 5836)
      • Update.exe (PID: 5096)
      • Update.exe (PID: 3848)

    • Reads Environment values

      • Client-built.exe (PID: 5836)
      • Update.exe (PID: 3848)
      • Update.exe (PID: 5096)

    • Reads the machine GUID from the registry

      • Client-built.exe (PID: 5836)
      • Update.exe (PID: 5096)
      • Update.exe (PID: 3848)

    • Launching a file from a Registry key

      • Update.exe (PID: 5096)
      • Client-built.exe (PID: 5836)

    • Manual execution by a user

      • Update.exe (PID: 3848)

    • Checks proxy server information

      • slui.exe (PID: 4320)

    • Reads the software policy settings

      • slui.exe (PID: 4320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2077:09:19 15:18:11+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 1865216
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x1c943e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.7.4.0
ProductVersionNumber: 1.7.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.7.4
InternalName: Client.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: -
ProductVersion: 1.7.4
AssemblyVersion: 1.7.4.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start client-built.exe update.exe update.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3848"C:\Users\admin\AppData\Roaming\Discords\Update.exe"C:\Users\admin\AppData\Roaming\Discords\Update.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Version:
1.7.4
4320C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
5096"C:\Users\admin\AppData\Roaming\Discords\Update.exe"C:\Users\admin\AppData\Roaming\Discords\Update.exe
Client-built.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.7.4
5836"C:\Users\admin\Desktop\Client-built.exe" C:\Users\admin\Desktop\Client-built.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3
Version:
1.7.4
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5836Client-built.exeC:\Users\admin\AppData\Roaming\Discords\Update.exeexecutable
MD5:919D1A18BBA310BD0D451CE41A8FA5CB
SHA256:AEAC308D2F6A25DA39DABACC4111F924834CBAF609998BEB7922147988B48B67
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
53
DNS requests
15
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
92.123.104.33:443
https://www.bing.com/DSB/search?dsbmr=1&format=dsbjson&client=windowsminiserp&dsbschemaversion=1.1&dsbminiserp=1&q=q&cc=US&setlang=en-us&clientDateTime=10%2F3%2F2025%2C%204%3A51%3A33%20PM
unknown
binary
62.5 Kb
—
—
—
POST
204
92.123.104.33:443
https://www.bing.com/web/xlsc.aspx?t=5&dl=1&wsbc=1
unknown
—
—
—
—
—
POST
200
40.126.31.71:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
—
—
—
GET
200
92.123.104.33:443
https://www.bing.com/th?id=ODSWG.8229b0e5-fa8c-4e4a-af74-69717698b903&pid=dsb
unknown
image
4.62 Kb
—
—
—
POST
200
40.126.31.71:443
https://login.live.com/RST2.srf
unknown
xml
11.2 Kb
—
—
—
POST
200
40.126.31.128:443
https://login.live.com/RST2.srf
unknown
xml
11.3 Kb
—
—
—
POST
200
20.190.159.73:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
—
—
—
GET
200
92.123.104.16:443
https://www.bing.com/th?id=ODSWG.31bcf3d1-4df8-4c6a-9b3a-447ced8d6c39&pid=dsb
unknown
image
4.64 Kb
—
—
—
POST
200
40.126.31.69:443
https://login.live.com/RST2.srf
unknown
xml
11.3 Kb
—
—
—
GET
200
20.223.35.26:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20251003T165133Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=68551dd57f1141ae8f756ce3ded0673e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=134045512450000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1360&dispsize=16.3&dispvertres=768&fosver=16299&isu=0&lo=4245650&metered=false&nettype=ethernet&npid=sc-310091&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&rver=2&smBiosDm=DELL&stabedgever=133.0.3065.92&tl=2&tsu=1636180&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
1.34 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6016
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
8100
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
92.123.104.41:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5948
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5096
Update.exe
5.83.154.54:8080
—
—
DE
unknown
5224
SearchApp.exe
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted
7604
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
www.bing.com
  • 92.123.104.41
  • 92.123.104.38
  • 92.123.104.42
  • 92.123.104.46
  • 92.123.104.51
  • 92.123.104.52
  • 92.123.104.50
  • 92.123.104.37
  • 92.123.104.49
whitelisted
google.com
  • 142.250.181.238
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.3
  • 20.190.160.20
  • 40.126.32.68
  • 20.190.160.66
  • 20.190.160.14
  • 20.190.160.67
  • 40.126.32.134
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Client-built.exe