File name:

GuildBorn1.0.0.msi

Full analysis: https://app.any.run/tasks/df6ae60d-ea10-4254-ab01-242f54e0afdb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 03, 2025, 22:15:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
stealer
loader
discordgrabber
generic
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GuildBorn, Author: Unreal Game Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install GuildBorn., Template: x64;1033, Revision Number: {2D9520B3-6654-4F81-95CC-12C9A34675E5}, Create Time/Date: Wed Jul 2 02:29:26 2025, Last Saved Time/Date: Wed Jul 2 02:29:26 2025, Number of Pages: 500, Number of Words: 2, Name of Creating Application: WiX Toolset (4.0.0.5512), Security: 2
MD5:

926235FD2A5DA105132F3DFE486782E1

SHA1:

A2C0F46BACBACE5592E2C9C22AADCEF0C0666B2E

SHA256:

1009EC53E19281E42F4369264FA7B737F3D19F3E542CF19E3AB71909CF5618F4

SSDEEP:

786432:8isTv6NIvcJt9w2bywlG9ODbszPY8k+TGK8aKiJML97VbZq:8isr6NIEJt9iMWY8kbK8a7JML9JbZq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • wscript.exe (PID: 7160)

    • Steals credentials from Web Browsers

      • GuildBorn.exe (PID: 4804)

    • Actions looks like stealing of personal data

      • GuildBorn.exe (PID: 4804)

    • Modifies files in the Chrome extension folder

      • GuildBorn.exe (PID: 4804)

    • DISCORDGRABBER has been detected (YARA)

      • GuildBorn.exe (PID: 4804)

    • Changes Windows Defender settings

      • wscript.exe (PID: 7160)

    • Suspicious browser debugging (Possible cookie theft)

      • msedge.exe (PID: 7728)
      • msedge.exe (PID: 7848)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 4664)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5928)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 5928)

    • Application launched itself

      • GuildBorn.exe (PID: 4804)
      • wscript.exe (PID: 6612)
      • wscript.exe (PID: 4916)

    • The process executes VB scripts

      • cmd.exe (PID: 7160)
      • cmd.exe (PID: 6348)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 536)
      • GuildBorn.exe (PID: 4804)
      • wscript.exe (PID: 6612)
      • cmd.exe (PID: 4916)
      • wscript.exe (PID: 4916)

    • Starts CMD.EXE for commands execution

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6612)
      • wscript.exe (PID: 7160)
      • wscript.exe (PID: 4916)
      • cscript.exe (PID: 2976)

    • Script adds exclusion path to Windows Defender

      • wscript.exe (PID: 7160)

    • Manipulates environment variables

      • powershell.exe (PID: 2680)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 7160)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 3620)
      • cmd.exe (PID: 7752)
      • cmd.exe (PID: 7480)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7180)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 4916)

    • MS Edge headless start

      • msedge.exe (PID: 7848)
      • msedge.exe (PID: 8056)
      • msedge.exe (PID: 7728)

    • Reads security settings of Internet Explorer

      • GuildBorn.exe (PID: 5908)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 5928)
      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 6376)
      • GuildBorn.exe (PID: 5184)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)
      • identity_helper.exe (PID: 5104)
      • GuildBorn.exe (PID: 5908)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 5928)
      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 5908)

    • An automatically generated document

      • msiexec.exe (PID: 6748)

    • Reads the computer name

      • msiexec.exe (PID: 5928)
      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 6376)
      • GuildBorn.exe (PID: 5184)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)
      • identity_helper.exe (PID: 5104)
      • GuildBorn.exe (PID: 5908)

    • Manages system restore points

      • SrTasks.exe (PID: 6236)

    • Reads product name

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)

    • The sample compiled with english language support

      • msiexec.exe (PID: 5928)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5928)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5928)

    • Reads Environment values

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)
      • identity_helper.exe (PID: 5104)
      • GuildBorn.exe (PID: 5908)

    • Reads the machine GUID from the registry

      • GuildBorn.exe (PID: 4804)
      • GuildBorn.exe (PID: 5908)

    • Checks proxy server information

      • GuildBorn.exe (PID: 4804)
      • slui.exe (PID: 6488)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 5552)
      • cscript.exe (PID: 2864)
      • cscript.exe (PID: 4164)
      • cscript.exe (PID: 4264)
      • cscript.exe (PID: 2976)

    • Create files in a temporary directory

      • GuildBorn.exe (PID: 4804)
      • evilsoul_f3bfea2d36e77b2a.exe (PID: 3392)

    • Application launched itself

      • chrome.exe (PID: 5780)
      • chrome.exe (PID: 7212)
      • msedge.exe (PID: 7848)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2680)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2680)

    • Reads the software policy settings

      • GuildBorn.exe (PID: 5908)
      • slui.exe (PID: 6488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: GuildBorn
Author: Unreal Game Inc.
Keywords: Installer
Comments: This installer database contains the logic and data required to install GuildBorn.
Template: x64;1033
RevisionNumber: {2D9520B3-6654-4F81-95CC-12C9A34675E5}
CreateDate: 2025:07:02 02:29:26
ModifyDate: 2025:07:02 02:29:26
Pages: 500
Words: 2
Software: WiX Toolset (4.0.0.5512)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
203
Monitored processes
77
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs #DISCORDGRABBER guildborn.exe guildborn.exe no specs guildborn.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe powershell.exe no specs conhost.exe no specs slui.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs cscript.exe no specs evilsoul_f3bfea2d36e77b2a.exe conhost.exe no specs cmd.exe no specs reg.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs guildborn.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4460,i,15076537969571948191,16805046044605086254,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4476 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
320"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3828,i,17159436287056569763,2202446976901978766,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=2248,i,15076537969571948191,16805046044605086254,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2396 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
536C:\WINDOWS\system32\cmd.exe /d /s /c "cscript //Nologo "C:\Users\admin\AppData\Local\Temp\1339159155.vbs""C:\Windows\System32\cmd.exe—GuildBorn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392taskkill /F /IM chrome.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1828taskkill /F /T /IM msedge.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—evilsoul_f3bfea2d36e77b2a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,15076537969571948191,16805046044605086254,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2628 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
34 630
Read events
34 227
Write events
384
Delete events
19

Modification events

(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000003CA7390568ECDB0128170000C8150000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000003CA7390568ECDB0128170000C8150000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000803F620568ECDB0128170000C8150000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000803F620568ECDB0128170000C8150000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000008692640568ECDB0128170000C8150000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000077F6660568ECDB0128170000C8150000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000DED19D0568ECDB0128170000C8150000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5928) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009F35A00568ECDB0128170000300B0000E803000001000000000000000000000039972FDEB1B1544DB7C899CDAE0A07B200000000000000000000000000000000
(PID) Process:(4664) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
48000000000000003B47B30568ECDB0138120000D8120000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
9
Suspicious files
113
Text files
131
Unknown types
83

Dropped files

PID
Process
Filename
Type
5928msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
5928msiexec.exeC:\Windows\Installer\17adf3.msi —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\GuildBorn.exe —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\LICENSES.chromium.html —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\icudtl.dat —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\resources.pak —
MD5:—
SHA256:—
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\resources\app.asar —
MD5:—
SHA256:—
5928msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:EA9BCE2B308264DC5B99B303CD04B976
SHA256:3CCA844FBBEEA5862AEAC2A5C1AABA3D8C05FA96F5A676976360093D834D7D30
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\resources\app.asar.unpacked\node_modules\sqlite3\package.jsonbinary
MD5:174BF28FCCD7FDB6F0766F31FAC3060D
SHA256:91008A93E604674024BD65569670AF5B01F1E4CAF86CDE50835EE58F59A5DC61
5928msiexec.exeC:\Users\admin\AppData\Local\Programs\guildborn\libEGL.dllexecutable
MD5:1DCF5AC3CB0DCDA9C9679EEB018D01BD
SHA256:9CFC3001191E8B3EB9C96BA29E57E5BF9AAAB264E83897E47CB968167A8A811B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
70
TCP/UDP connections
93
DNS requests
56
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
3.125.102.39:443
https://d760-18-188-171-105.ngrok-free.app/download/vbs
unknown
text
658 b
malicious
4804
GuildBorn.exe
GET
307
3.125.209.94:80
http://d760-18-188-171-105.ngrok-free.app/download/vbs
unknown
—
—
malicious
4804
GuildBorn.exe
GET
307
3.125.209.94:80
http://d760-18-188-171-105.ngrok-free.app/download/panel
unknown
—
—
malicious
—
—
GET
200
3.124.142.205:443
https://d760-18-188-171-105.ngrok-free.app/download/panel
unknown
executable
66.4 Mb
malicious
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
GET
200
216.58.206.42:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
unknown
binary
41 b
whitelisted
—
—
POST
200
142.250.27.84:443
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
unknown
text
17 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
d760-18-188-171-105.ngrok-free.app
  • 3.125.209.94
  • 18.158.249.75
  • 18.192.31.165
  • 3.125.102.39
  • 3.125.223.134
  • 3.124.142.205
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
0dcf-18-188-171-105.ngrok-free.app
  • 3.124.142.205
  • 18.158.249.75
  • 3.125.209.94
  • 18.192.31.165
  • 3.125.223.134
  • 3.125.102.39
malicious
clients2.google.com
  • 142.250.185.206
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 216.58.206.42
  • 142.250.181.234
  • 142.250.185.202
  • 172.217.16.202
  • 142.250.186.74
  • 142.250.185.74
  • 142.250.184.202
  • 142.250.186.138
  • 142.250.185.106
  • 142.250.186.170
  • 216.58.212.138
  • 142.250.186.42
  • 142.250.185.138
  • 142.250.185.234
  • 142.250.185.170
  • 172.217.23.106
whitelisted
clientservices.googleapis.com
  • 142.250.184.195
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .app)
—
—
A Network Trojan was detected
SUSPICIOUS [ANY.RUN] VBS is used to run Shell
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2200
svchost.exe
Misc activity
ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .app)
—
—
Generic Protocol Command Decode
SURICATA HTTP file name too long
2200
svchost.exe
Misc activity
ET INFO Observed DNS Query to *.ngrok Domain (ngrok-free .app)
Process
Message
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Microsoft\Edge\User Data directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GuildBorn1.0.0.msi