File name:

GSAutoClicker-Setup.exe

Full analysis: https://app.any.run/tasks/3b89d16c-6e98-4945-864d-e4ab3a01043a
Verdict: Malicious activity
Analysis date: February 12, 2024, 14:14:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6862F65BE14FD3CE88086EC79777DB6E

SHA1:

7F0EB7535B59A926446A400FF93F48165B58AC95

SHA256:

7C90795C9B28FAC978386626F5A54033DC9CBA46EF6A3F742FC7D52B394590F2

SSDEEP:

12288:saWzgMg7v3qnCibErQohh0F4zCJ8lnywQ8S8Xe74050MOm:TaHMv6Cbrj/nywQ8Sfs+7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • GSAutoClicker-Setup.exe (PID: 3700)
      • Skype-Setup.exe (PID: 4000)
      • Skype-Setup.exe (PID: 1768)
      • Skype-Setup.tmp (PID: 2900)

    • Actions looks like stealing of personal data

      • Skype-Setup.tmp (PID: 2900)

    • Changes the autorun value in the registry

      • reg.exe (PID: 316)

  • SUSPICIOUS

    • Application launched itself

      • Skype.exe (PID: 3664)
      • Skype.exe (PID: 1816)

    • Reads the Internet Settings

      • Skype.exe (PID: 3664)
      • Skype-Setup.tmp (PID: 3180)
      • Skype-Setup.tmp (PID: 2900)
      • Skype.exe (PID: 1816)

    • Executable content was dropped or overwritten

      • Skype-Setup.exe (PID: 4000)
      • Skype-Setup.exe (PID: 1768)
      • Skype-Setup.tmp (PID: 2900)

    • Reads the Windows owner or organization settings

      • Skype-Setup.tmp (PID: 2900)

    • Searches for installed software

      • Skype-Setup.tmp (PID: 2900)

    • Uses TASKKILL.EXE to kill process

      • Skype-Setup.tmp (PID: 2900)

    • The process drops C-runtime libraries

      • Skype-Setup.tmp (PID: 2900)

    • Process drops legitimate windows executable

      • Skype-Setup.tmp (PID: 2900)

    • Reads security settings of Internet Explorer

      • Skype-Setup.tmp (PID: 3180)
      • Skype-Setup.tmp (PID: 2900)

    • Uses REG/REGEDIT.EXE to modify registry

      • Skype.exe (PID: 1816)

    • Reads settings of System Certificates

      • Skype.exe (PID: 1816)

  • INFO

    • Reads the computer name

      • GSAutoClicker-Setup.exe (PID: 3700)
      • Skype.exe (PID: 3664)
      • Skype.exe (PID: 4060)
      • Skype.exe (PID: 2124)
      • Skype.exe (PID: 2208)
      • Skype-Setup.tmp (PID: 3180)
      • Skype.exe (PID: 1740)
      • Skype-Setup.tmp (PID: 2900)
      • Skype.exe (PID: 1816)
      • Skype.exe (PID: 1596)
      • Skype.exe (PID: 2808)
      • Skype.exe (PID: 2128)
      • Skype.exe (PID: 2024)

    • Reads mouse settings

      • GSAutoClicker-Setup.exe (PID: 3700)

    • Checks supported languages

      • GSAutoClicker-Setup.exe (PID: 3700)
      • Skype.exe (PID: 3664)
      • Skype.exe (PID: 1776)
      • Skype.exe (PID: 4060)
      • Skype-Setup.exe (PID: 4000)
      • Skype.exe (PID: 2124)
      • Skype.exe (PID: 2208)
      • Skype-Setup.tmp (PID: 3180)
      • Skype.exe (PID: 1740)
      • Skype-Setup.exe (PID: 1768)
      • Skype-Setup.tmp (PID: 2900)
      • Skype.exe (PID: 1816)
      • Skype.exe (PID: 3088)
      • Skype.exe (PID: 1596)
      • Skype.exe (PID: 2128)
      • Skype.exe (PID: 2808)
      • Skype.exe (PID: 2024)
      • Skype.exe (PID: 2824)

    • Create files in a temporary directory

      • GSAutoClicker-Setup.exe (PID: 3700)
      • Skype-Setup.tmp (PID: 2900)
      • Skype-Setup.exe (PID: 4000)
      • Skype-Setup.exe (PID: 1768)
      • Skype.exe (PID: 1816)

    • Reads product name

      • Skype.exe (PID: 3664)
      • Skype.exe (PID: 1816)
      • Skype.exe (PID: 2808)

    • Manual execution by a user

      • Skype.exe (PID: 3664)

    • Reads Environment values

      • Skype.exe (PID: 3664)
      • Skype.exe (PID: 1816)
      • Skype.exe (PID: 2808)

    • Creates files or folders in the user directory

      • Skype.exe (PID: 3664)
      • Skype.exe (PID: 1816)
      • Skype.exe (PID: 2808)
      • Skype.exe (PID: 2128)

    • Reads CPU info

      • Skype.exe (PID: 3664)
      • Skype.exe (PID: 1816)

    • Creates files in the program directory

      • Skype-Setup.tmp (PID: 2900)

    • Creates a software uninstall entry

      • Skype-Setup.tmp (PID: 2900)

    • Process checks computer location settings

      • Skype.exe (PID: 1816)
      • Skype.exe (PID: 2808)
      • Skype.exe (PID: 2824)

    • Reads the machine GUID from the registry

      • Skype.exe (PID: 1816)

    • Reads the software policy settings

      • Skype.exe (PID: 1816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:05:30 16:33:32+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 524800
InitializedDataSize: 122368
UninitializedDataSize: -
EntryPoint: 0x16310
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.1.4.0
ProductVersionNumber: 3.1.4.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: www.goldensoft.org
FileDescription: GS Auto Clicker
FileVersion: 3.1.4
LegalCopyright: goldensoft.org
ProductName: GS Auto Clicker
ProductVersion: 3.1.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
36
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start gsautoclicker-setup.exe no specs skype.exe skype.exe skype.exe no specs skype.exe no specs skype-setup.exe skype.exe no specs skype-setup.tmp no specs skype.exe no specs skype-setup.exe skype-setup.tmp taskkill.exe no specs skype.exe skype.exe skype.exe no specs skype.exe reg.exe reg.exe no specs skype.exe no specs skype.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs skype.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\System32\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
392C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" /veC:\Windows\System32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
584C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice /v ProgIdC:\Windows\System32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
984C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Skype /v RestartForUpdateC:\Windows\System32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1264C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype For Desktop"C:\Windows\System32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1388C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Edge\BLBeacon /v versionC:\Windows\System32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1596"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1276 --field-trial-handle=1312,i,13609472339422042594,8617103237362607802,131072 --enable-features=WinUseBrowserSpellChecker,WinUseHybridSpellChecker,WinrtGeolocationImplementation --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
LOW
Description:
Skype
Exit code:
0
Version:
8.110.0.218
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1740"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1700 --field-trial-handle=1324,i,8329766343524155532,4035268083420696267,131072 --enable-features=WinUseBrowserSpellChecker,WinUseHybridSpellChecker,WinrtGeolocationImplementation --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
LOW
Description:
Skype
Exit code:
1
Version:
8.110.0.215
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1768"C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Skype-Setup.exe" /SPAWNWND=$E018A /NOTIFYWND=$100140 /silent !desktopiconC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Skype-Setup.exe
Skype-Setup.tmp
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
HIGH
Description:
Skype Setup
Exit code:
0
Version:
8.110.0.218
Modules
Images
c:\users\admin\appdata\roaming\microsoft\skype for desktop\skype-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1776"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop" /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad" --url=appcenter://generic?aid=a7417433-29d9-4bc0-8826-af367733939d&iid=ad142ee9-ecfe-4580-ec0f-259fb963ccd2&uid=ad142ee9-ecfe-4580-ec0f-259fb963ccd2 --annotation=IsOfficialBuild=1 --annotation=_companyName=Skype --annotation=_productName=skype-preview --annotation=_version=8.110.0.215 "--annotation=exe=C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=19.1.8 --initial-client-data=0x32c,0x330,0x334,0x328,0x338,0x7c9c2d8,0x7c9c2e8,0x7c9c2f4C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
1
Version:
8.110.0.215
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
12 447
Read events
12 367
Write events
72
Delete events
8

Modification events

(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
540B000094554DEFBD5DDA01
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
E3CE168F62928498BFBBF3364A7E25AE756C9AD02F22DAD744A9A1C5690807B8
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Microsoft\Skype for Desktop\api-ms-win-core-console-l1-1-0.dll
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
93AF8885B71171EBC56211119DF057BB682302BBF1E19902BCF42E4244039DE2
(PID) Process:(2900) Skype-Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\ShareWithSkype
Operation:writeName:icon
Value:
C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Executable files
146
Suspicious files
151
Text files
95
Unknown types
20

Dropped files

PID
Process
Filename
Type
2900Skype-Setup.tmp —
MD5:—
SHA256:—
3700GSAutoClicker-Setup.exeC:\Users\admin\AppData\Local\Temp\mptbdrxtext
MD5:639F2693CB4378A7233F683F3AAF17BF
SHA256:1276558EA596EFFE0B0343B524B43CDB91DC2AD5FE98DA66448AFF1B4B1DC4FA
3664Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\settings.jsonbinary
MD5:8AAB3FFA37C9CEF3FF1B107AE8FD1335
SHA256:AB9B6A671A41D213308E5D83C4DC72F090C25CD97392CB43A6EEF2FB55159833
3664Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.oldtext
MD5:AEAB6EEF48334E4749D630894ADCA674
SHA256:7B1139E4ABA3CF16CA2C097DC19F515B73C934315CC497769B6627C6252AE264
3664Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad\settings.datbinary
MD5:3B2AEFD32F61DB8110091B81A16A9AD1
SHA256:27A6D2020F45CD9D3F4DFCF837EC661A1D997B08D23E3CB41B94186C21A50B37
2900Skype-Setup.tmpC:\Program Files\Microsoft\Skype for Desktop\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:8894176AF3EA65A09AE5CF4C0E6FF50F
SHA256:C64B7C6400E9BACC1A4F1BAED6374BFBCE9A3F8CF20C2D03F81EF18262F89C60
1768Skype-Setup.exeC:\Users\admin\AppData\Local\Temp\is-7798B.tmp\Skype-Setup.tmpexecutable
MD5:55364BFEA54A03CCBA0F0400DF3D629F
SHA256:94B0E7DCDE2CBE4543EB28111FC5567EA622437F5A58A5E716BB7CFE0BF8DFAE
3664Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOGtext
MD5:D021280DC399CB212FEF29D4CCEE990A
SHA256:7F50A1C7AC0A012AE9B74329707ED62592875689EEEA74A1215E2CB5AFA26762
2900Skype-Setup.tmpC:\Program Files\Microsoft\Skype for Desktop\is-VBBQ3.tmpexecutable
MD5:55364BFEA54A03CCBA0F0400DF3D629F
SHA256:94B0E7DCDE2CBE4543EB28111FC5567EA622437F5A58A5E716BB7CFE0BF8DFAE
2900Skype-Setup.tmpC:\Program Files\Microsoft\Skype for Desktop\is-PDEK2.tmpexecutable
MD5:879920C7FA905036856BCB10875121D9
SHA256:7E4CBA620B87189278B5631536CDAD9BFDA6E12ABD8E4EB647CB85369A204FE8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
22
DNS requests
22
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3664
Skype.exe
52.113.194.133:443
get.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3664
Skype.exe
13.107.43.16:443
a.config.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3664
Skype.exe
23.213.164.171:443
download.skype.com
AKAMAI-AS
DE
unknown
1816
Skype.exe
13.107.43.16:443
a.config.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1816
Skype.exe
52.113.194.133:443
get.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1816
Skype.exe
52.182.143.213:443
pipe.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1816
Skype.exe
23.213.164.171:443
download.skype.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
get.skype.com
  • 52.113.194.133
whitelisted
a.config.skype.com
  • 13.107.43.16
whitelisted
download.skype.com
  • 23.213.164.171
whitelisted
pipe.skype.com
  • 52.182.143.213
whitelisted
eagle.sapphire.microsoftapp.net
  • 13.107.246.63
  • 13.107.213.63
unknown
gateway.bingviz.microsoftapp.net
  • 13.107.213.63
  • 13.107.246.63
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.2
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.75
whitelisted
logincdn.msftauth.net
  • 192.229.221.185
whitelisted
acctcdn.msauth.net
  • 13.107.213.63
  • 13.107.246.63
whitelisted

Threats

No threats detected
Process
Message
Skype.exe
[0212/141526.862:ERROR:filesystem_win.cc(130)] GetFileAttributes C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad\attachments\3a0ee62b-79ac-4cc3-bbd5-f65252e7a91f: The system cannot find the file specified. (0x2)
Skype.exe
[0212/141549.183:ERROR:filesystem_win.cc(130)] GetFileAttributes C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad\attachments\3a0ee62b-79ac-4cc3-bbd5-f65252e7a91f: The system cannot find the file specified. (0x2)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GSAutoClicker-Setup.exe