URL:

https://cdn-121.bayfiles.com/Z3407a71p7/584b188e-1610246410/Client-built.exe

Full analysis: https://app.any.run/tasks/a66b23e6-405b-44f4-858f-50129cabaf12
Verdict: Malicious activity
Analysis date: January 10, 2021, 02:35:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9C705F58FBEEB81CFC9674BFBB9AC750

SHA1:

75835E3FFED1F6388606C1582FE0771F82B72168

SHA256:

709FEC8869C8EB7D636019816AF8DB72D79D457F5D6967FA28527A02EFA15FC9

SSDEEP:

3:N8cFXSkWWLK5V3nVyhUdTFmJzIHZ8dAn:2cFNtK5V3oomJEBn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Client-built.exe (PID: 2756)

    • Changes the autorun value in the registry

      • reg.exe (PID: 1716)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2232)
      • iexplore.exe (PID: 2432)

    • Cleans NTFS data-stream (Zone Identifier)

      • Client-built.exe (PID: 2756)

    • Application launched itself

      • Skype.exe (PID: 376)
      • Skype.exe (PID: 2592)
      • Skype.exe (PID: 3644)

    • Reads CPU info

      • Skype.exe (PID: 376)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 376)

    • Creates files in the user directory

      • Skype.exe (PID: 376)
      • Skype.exe (PID: 3644)
      • Skype.exe (PID: 2592)

    • Changes default file association

      • Skype.exe (PID: 376)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1288)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2432)
      • Skype.exe (PID: 376)

    • Application launched itself

      • iexplore.exe (PID: 2232)
      • chrome.exe (PID: 1288)
      • firefox.exe (PID: 4004)
      • firefox.exe (PID: 1916)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2232)

    • Manual execution by user

      • Skype.exe (PID: 376)
      • opera.exe (PID: 1684)
      • chrome.exe (PID: 1288)
      • firefox.exe (PID: 1916)
      • wmplayer.exe (PID: 2652)
      • explorer.exe (PID: 3588)

    • Changes internet zones settings

      • iexplore.exe (PID: 2232)

    • Reads the hosts file

      • Skype.exe (PID: 376)
      • chrome.exe (PID: 1288)
      • chrome.exe (PID: 2200)

    • Creates files in the user directory

      • opera.exe (PID: 1684)
      • firefox.exe (PID: 4004)

    • Reads CPU info

      • firefox.exe (PID: 4004)

    • Creates files in the program directory

      • firefox.exe (PID: 4004)

    • Dropped object may contain Bitcoin addresses

      • Skype.exe (PID: 376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
87
Monitored processes
48
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe client-built.exe no specs skype.exe opera.exe skype.exe chrome.exe chrome.exe no specs chrome.exe no specs firefox.exe no specs reg.exe chrome.exe no specs chrome.exe firefox.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs skype.exe no specs reg.exe no specs firefox.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe chrome.exe no specs wmplayer.exe no specs explorer.exe no specs chrome.exe no specs skype.exe setup_wm.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe chrome.exe no specs chrome.exe no specs firefox.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs skype.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs skype.exe chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
explorer.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,17917889563556861208,11257510374991666061,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6862264515355180913 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
772"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.13.1177938761\22988052" -childID 2 -isForBrowser -prefsHandle 2752 -prefMapHandle 2756 -prefsLen 5997 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 2772 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1088"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,17917889563556861208,11257510374991666061,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=11499344401508387587 --mojo-platform-channel-handle=2904 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1096"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
1288"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1684"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
1716C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\system32\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1752"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
1916"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
Total events
1 823
Read events
1 628
Write events
191
Delete events
4

Modification events

(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1432976496
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30861049
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2232) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
3
Suspicious files
84
Text files
253
Unknown types
49

Dropped files

PID
Process
Filename
Type
2432iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab335E.tmp —
MD5:—
SHA256:—
2432iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar335F.tmp —
MD5:—
SHA256:—
2232iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3BCEB511E5F0594C.TMP —
MD5:—
SHA256:—
2232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Client-built.exe.rubaa2e.partial:Zone.Identifier —
MD5:—
SHA256:—
1288chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FFA680E-508.pma —
MD5:—
SHA256:—
376Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\34PVKS3AWHA4GYSNGWVL.temp —
MD5:—
SHA256:—
1288chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
1288chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old —
MD5:—
SHA256:—
1288chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
1288chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF159dc0.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
53
DNS requests
86
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2432
iexplore.exe
GET
200
2.16.186.27:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
unknown
der
1.16 Kb
whitelisted
4004
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4004
firefox.exe
POST
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
4004
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2432
iexplore.exe
GET
200
2.16.186.10:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
unknown
der
1.16 Kb
whitelisted
4004
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4004
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
text
8 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2200
chrome.exe
172.217.16.129:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
—
—
45.154.253.50:443
cdn-121.bayfiles.com
—
—
unknown
2432
iexplore.exe
45.154.253.50:443
cdn-121.bayfiles.com
—
—
unknown
2432
iexplore.exe
2.16.186.10:80
crl.identrust.com
Akamai International B.V.
—
whitelisted
2432
iexplore.exe
2.16.186.27:80
crl.identrust.com
Akamai International B.V.
—
whitelisted
376
Skype.exe
52.174.193.75:443
get.skype.com
Microsoft Corporation
NL
whitelisted
376
Skype.exe
2.18.233.81:443
download.skype.com
Akamai International B.V.
—
whitelisted
376
Skype.exe
13.107.42.23:443
a.config.skype.com
Microsoft Corporation
US
suspicious
2200
chrome.exe
74.125.124.94:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
1684
opera.exe
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted

DNS requests

Domain
IP
Reputation
cdn-121.bayfiles.com
  • 45.154.253.50
unknown
crl.identrust.com
  • 2.16.186.10
  • 2.16.186.27
whitelisted
get.skype.com
  • 52.174.193.75
whitelisted
a.config.skype.com
  • 13.107.42.23
whitelisted
download.skype.com
  • 2.18.233.81
whitelisted
clientservices.googleapis.com
  • 74.125.124.94
whitelisted
accounts.google.com
  • 172.217.212.84
shared
certs.opera.com
  • 185.26.182.94
  • 185.26.182.93
whitelisted
www.google.com.ua
  • 172.217.18.3
whitelisted
clients2.google.com
  • 172.217.18.174
whitelisted

Threats

PID
Process
Class
Message
1684
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1684
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1684
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1684
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1060
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1060
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
Process
Message
Skype.exe
[1096:2532:0110/023557.448:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[1096:2532:0110/023557.448:VERBOSE1:crash_service.cc(145)] window handle is 00050146
Skype.exe
[1096:2532:0110/023557.448:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[1096:2532:0110/023557.448:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[1096:2532:0110/023557.448:VERBOSE1:crash_service_main.cc(94)] Ready to process crash requests
Skype.exe
[1096:2820:0110/023557.448:VERBOSE1:crash_service.cc(333)] client start. pid = 376
Skype.exe
[1096:2820:0110/023605.937:VERBOSE1:crash_service.cc(333)] client start. pid = 3644
Skype.exe
[1752:1360:0110/023609.104:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[1752:1360:0110/023609.106:VERBOSE1:crash_service.cc(145)] window handle is 000302A2
Skype.exe
[1752:1360:0110/023609.108:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn-121.bayfiles.com/Z3407a71p7/584b188e-1610246410/Client-built.exe