File name:

GuildBorn1.0.0.msi

Full analysis: https://app.any.run/tasks/df6ae60d-ea10-4254-ab01-242f54e0afdb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 03, 2025, 22:15:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
stealer
loader
discordgrabber
generic
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GuildBorn, Author: Unreal Game Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install GuildBorn., Template: x64;1033, Revision Number: {2D9520B3-6654-4F81-95CC-12C9A34675E5}, Create Time/Date: Wed Jul 2 02:29:26 2025, Last Saved Time/Date: Wed Jul 2 02:29:26 2025, Number of Pages: 500, Number of Words: 2, Name of Creating Application: WiX Toolset (4.0.0.5512), Security: 2
MD5:

926235FD2A5DA105132F3DFE486782E1

SHA1:

A2C0F46BACBACE5592E2C9C22AADCEF0C0666B2E

SHA256:

1009EC53E19281E42F4369264FA7B737F3D19F3E542CF19E3AB71909CF5618F4

SSDEEP:

786432:8isTv6NIvcJt9w2bywlG9ODbszPY8k+TGK8aKiJML97VbZq:8isr6NIEJt9iMWY8kbK8a7JML9JbZq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DISCORDGRABBER has been detected (YARA)

      • GuildBorn.exe (PID: 4804)

    • Adds path to the Windows Defender exclusion list

      • wscript.exe (PID: 7160)

    • Changes Windows Defender settings

      • wscript.exe (PID: 7160)

    • Actions looks like stealing of personal data

      • GuildBorn.exe (PID: 4804)

    • Modifies files in the Chrome extension folder

      • GuildBorn.exe (PID: 4804)

    • Steals credentials from Web Browsers

      • GuildBorn.exe (PID: 4804)

    • Suspicious browser debugging (Possible cookie theft)

      • msedge.exe (PID: 7848)
      • msedge.exe (PID: 7728)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 5928)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4664)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5928)

    • Application launched itself

      • GuildBorn.exe (PID: 4804)
      • wscript.exe (PID: 6612)
      • wscript.exe (PID: 4916)

    • The process executes VB scripts

      • cmd.exe (PID: 6348)
      • cmd.exe (PID: 7160)
      • cmd.exe (PID: 536)
      • wscript.exe (PID: 6612)
      • GuildBorn.exe (PID: 4804)
      • cmd.exe (PID: 6584)
      • wscript.exe (PID: 4916)
      • cmd.exe (PID: 4916)

    • Starts CMD.EXE for commands execution

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6612)
      • wscript.exe (PID: 4916)
      • wscript.exe (PID: 7160)
      • cscript.exe (PID: 2976)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 4916)

    • Script adds exclusion path to Windows Defender

      • wscript.exe (PID: 7160)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 3620)
      • cmd.exe (PID: 7480)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7752)
      • cmd.exe (PID: 7180)

    • Manipulates environment variables

      • powershell.exe (PID: 2680)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 7160)

    • MS Edge headless start

      • msedge.exe (PID: 7728)
      • msedge.exe (PID: 7848)
      • msedge.exe (PID: 8056)

    • Reads security settings of Internet Explorer

      • GuildBorn.exe (PID: 5908)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 5928)
      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 6376)
      • GuildBorn.exe (PID: 5184)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)
      • identity_helper.exe (PID: 5104)
      • GuildBorn.exe (PID: 5908)

    • An automatically generated document

      • msiexec.exe (PID: 6748)

    • Checks supported languages

      • msiexec.exe (PID: 5928)
      • GuildBorn.exe (PID: 6376)
      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 5184)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)
      • identity_helper.exe (PID: 5104)
      • GuildBorn.exe (PID: 5908)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 5928)
      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 5908)

    • Manages system restore points

      • SrTasks.exe (PID: 6236)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5928)

    • The sample compiled with english language support

      • msiexec.exe (PID: 5928)

    • Reads the machine GUID from the registry

      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 5908)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5928)

    • Reads product name

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)

    • Checks proxy server information

      • GuildBorn.exe (PID: 4804)
      • slui.exe (PID: 6488)

    • Reads Environment values

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)
      • identity_helper.exe (PID: 5104)
      • GuildBorn.exe (PID: 5908)

    • Create files in a temporary directory

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 4164)
      • cscript.exe (PID: 2864)
      • cscript.exe (PID: 5552)
      • cscript.exe (PID: 4264)
      • cscript.exe (PID: 2976)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2680)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2680)

    • Application launched itself

      • chrome.exe (PID: 5780)
      • chrome.exe (PID: 7212)
      • msedge.exe (PID: 7848)

    • Reads the software policy settings

      • slui.exe (PID: 6488)
      • GuildBorn.exe (PID: 5908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: GuildBorn
Author: Unreal Game Inc.
Keywords: Installer
Comments: This installer database contains the logic and data required to install GuildBorn.
Template: x64;1033
RevisionNumber: {2D9520B3-6654-4F81-95CC-12C9A34675E5}
CreateDate: 2025:07:02 02:29:26
ModifyDate: 2025:07:02 02:29:26
Pages: 500
Words: 2
Software: WiX Toolset (4.0.0.5512)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
203
Monitored processes
77
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs #DISCORDGRABBER guildborn.exe guildborn.exe no specs guildborn.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe powershell.exe no specs conhost.exe no specs slui.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs cscript.exe no specs evilsoul_f3bfea2d36e77b2a.exe conhost.exe no specs cmd.exe no specs reg.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs guildborn.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4460,i,15076537969571948191,16805046044605086254,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4476 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
320"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3828,i,17159436287056569763,2202446976901978766,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=2248,i,15076537969571948191,16805046044605086254,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2396 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
536C:\WINDOWS\system32\cmd.exe /d /s /c "cscript //Nologo "C:\Users\admin\AppData\Local\Temp\1339159155.vbs""C:\Windows\System32\cmd.exe—GuildBorn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392taskkill /F /IM chrome.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1828taskkill /F /T /IM msedge.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—evilsoul_f3bfea2d36e77b2a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,15076537969571948191,16805046044605086254,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2628 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
34 630
Read events
34 227
Write events
384
Delete events
19

Modification events

(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000003CA7390568ECDB0128170000C8150000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000003CA7390568ECDB0128170000C8150000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000803F620568ECDB0128170000C8150000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000803F620568ECDB0128170000C8150000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000008692640568ECDB0128170000C8150000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000077F6660568ECDB0128170000C8150000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000DED19D0568ECDB0128170000C8150000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009F35A00568ECDB0128170000300B0000E803000001000000000000000000000039972FDEB1B1544DB7C899CDAE0A07B200000000000000000000000000000000
(PID) Process:(4664) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
48000000000000003B47B30568ECDB0138120000D8120000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
9
Suspicious files
113
Text files
131
Unknown types
83

Dropped files

PID
Process
Filename
Type
5928msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
5928msiexec.exeC:\Windows\Installer\17adf3.msi —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\GuildBorn.exe —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\LICENSES.chromium.html —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\icudtl.dat —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\resources.pak —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\resources\app.asar —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\chrome_200_percent.pakpgc
MD5:C37BD7A6B677A37313B7ECC4FF01B6F5
SHA256:8C1AE81D19FD6323A02EB460E075E2F25ABA322BC7D46F2E6EDB1C4600E6537A
5928msiexec.exeC:\Windows\Installer\MSIB110.tmpbinary
MD5:905C55E01019D0DF18A4F60BF94F6277
SHA256:435E56162AF499A003C8E738C2326C196B38182ECA17008024080E9CF315F7A5
5928msiexec.exeC:\Windows\Temp\~DFD3EBF8B2F5328E61.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
70
TCP/UDP connections
93
DNS requests
56
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
3.125.102.39:443
https://d760-18-188-171-105.ngrok-free.app/download/vbs
unknown
text
658 b
malicious
4804
GuildBorn.exe
GET
307
3.125.209.94:80
http://d760-18-188-171-105.ngrok-free.app/download/vbs
unknown
—
—
malicious
4804
GuildBorn.exe
GET
307
3.125.209.94:80
http://d760-18-188-171-105.ngrok-free.app/download/panel
unknown
—
—
malicious
—
—
GET
200
3.124.142.205:443
https://d760-18-188-171-105.ngrok-free.app/download/panel
unknown
executable
66.4 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
d760-18-188-171-105.ngrok-free.app
  • 3.125.209.94
  • 18.158.249.75
  • 18.192.31.165
  • 3.125.102.39
  • 3.125.223.134
  • 3.124.142.205
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
0dcf-18-188-171-105.ngrok-free.app
  • 3.124.142.205
  • 18.158.249.75
  • 3.125.209.94
  • 18.192.31.165
  • 3.125.223.134
  • 3.125.102.39
malicious
clients2.google.com
  • 142.250.185.206
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 216.58.206.42
  • 142.250.181.234
  • 142.250.185.202
  • 172.217.16.202
  • 142.250.186.74
  • 142.250.185.74
  • 142.250.184.202
  • 142.250.186.138
  • 142.250.185.106
  • 142.250.186.170
  • 216.58.212.138
  • 142.250.186.42
  • 142.250.185.138
  • 142.250.185.234
  • 142.250.185.170
  • 172.217.23.106
whitelisted
clientservices.googleapis.com
  • 142.250.184.195
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .app)
—
—
A Network Trojan was detected
SUSPICIOUS [ANY.RUN] VBS is used to run Shell
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2200
svchost.exe
Misc activity
ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .app)
—
—
Generic Protocol Command Decode
SURICATA HTTP file name too long
2200
svchost.exe
Misc activity
ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .app)
Process
Message
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Microsoft\Edge\User Data directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GuildBorn1.0.0.msi