analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Screenshot.jpg

Full analysis: https://app.any.run/tasks/5026c1b7-1a07-4e72-892e-2ebd84f87206
Verdict: Malicious activity
Analysis date: May 20, 2022, 19:35:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: image/jpeg
File info: JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 1366x768, frames 3
MD5:

A5D3C962FCDB7CF3EAAE53245A7FEA18

SHA1:

2A5536AFC47E5E2BB767A2A1C7AEB09A26735686

SHA256:

E9E763F458C47F97873F6B1B9B16D4DDA2C54E8FBBF5195D681CDD4A98AC4762

SSDEEP:

3072:OcHtMr8nAOFFJ0pC3YktS9E823U1d7t/qYbWaf0:OmpPFMd9E8LqYbWas

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 3096)

  • SUSPICIOUS

    • Reads the computer name

      • Skype.exe (PID: 3848)
      • Skype.exe (PID: 3464)
      • Skype.exe (PID: 3048)
      • Skype.exe (PID: 2968)
      • Skype.exe (PID: 2584)
      • Skype.exe (PID: 3988)
      • Skype.exe (PID: 2856)
      • Skype.exe (PID: 1328)

    • Checks supported languages

      • Skype.exe (PID: 3848)
      • Skype.exe (PID: 3464)
      • Skype.exe (PID: 3048)
      • Skype.exe (PID: 2968)
      • Skype.exe (PID: 2584)
      • Skype.exe (PID: 3988)
      • Skype.exe (PID: 2856)
      • Skype.exe (PID: 1328)

    • Application launched itself

      • Skype.exe (PID: 3848)
      • Skype.exe (PID: 3048)
      • Skype.exe (PID: 2584)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 3848)

    • Reads CPU info

      • Skype.exe (PID: 3848)

    • Changes default file association

      • Skype.exe (PID: 3848)

    • Creates files in the user directory

      • Skype.exe (PID: 3848)
      • Skype.exe (PID: 3048)
      • Skype.exe (PID: 2584)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1592)

  • INFO

    • Checks supported languages

      • rundll32.exe (PID: 2972)
      • reg.exe (PID: 3096)
      • reg.exe (PID: 3128)
      • chrome.exe (PID: 1592)
      • chrome.exe (PID: 2528)
      • chrome.exe (PID: 2576)
      • chrome.exe (PID: 2424)
      • chrome.exe (PID: 2612)
      • chrome.exe (PID: 3632)
      • chrome.exe (PID: 2044)
      • chrome.exe (PID: 984)
      • chrome.exe (PID: 4044)
      • chrome.exe (PID: 3760)
      • chrome.exe (PID: 3880)
      • chrome.exe (PID: 3640)
      • chrome.exe (PID: 3444)
      • chrome.exe (PID: 1024)
      • chrome.exe (PID: 2432)
      • chrome.exe (PID: 976)
      • chrome.exe (PID: 3540)
      • chrome.exe (PID: 3216)
      • chrome.exe (PID: 3016)
      • chrome.exe (PID: 3352)
      • chrome.exe (PID: 2184)
      • chrome.exe (PID: 292)
      • chrome.exe (PID: 984)
      • chrome.exe (PID: 3640)
      • chrome.exe (PID: 1008)
      • chrome.exe (PID: 2816)

    • Manual execution by user

      • Skype.exe (PID: 3848)
      • chrome.exe (PID: 1592)

    • Reads the hosts file

      • Skype.exe (PID: 3848)
      • chrome.exe (PID: 2576)
      • chrome.exe (PID: 1592)

    • Dropped object may contain Bitcoin addresses

      • Skype.exe (PID: 3848)

    • Reads settings of System Certificates

      • Skype.exe (PID: 3848)
      • chrome.exe (PID: 2576)

    • Reads the computer name

      • chrome.exe (PID: 2576)
      • chrome.exe (PID: 2528)
      • chrome.exe (PID: 1592)
      • chrome.exe (PID: 3444)
      • chrome.exe (PID: 3760)
      • chrome.exe (PID: 3640)

    • Application launched itself

      • chrome.exe (PID: 1592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jpg | JFIF-EXIF JPEG Bitmap (38.4)
.jpg | JFIF JPEG bitmap (30.7)
.jpg | JPEG bitmap (23)
.mp3 | MP3 audio (7.6)

EXIF

Composite

Megapixels: 1
ImageSize: 1366x768

JFIF

YResolution: 96
XResolution: 96
ResolutionUnit: inches
JFIFVersion: 1.01
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
37
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs skype.exe skype.exe reg.exe skype.exe no specs reg.exe no specs skype.exe skype.exe no specs skype.exe skype.exe no specs skype.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2972"C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen "C:\Users\admin\AppData\Local\Temp\Screenshot.jpg"C:\Windows\System32\rundll32.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
3848"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Explorer.EXE
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
3464"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
3096C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\system32\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3048"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=DB62BA37FEAE558180DB519E56FA6AC6 --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=DB62BA37FEAE558180DB519E56FA6AC6 --renderer-client-id=3 --mojo-platform-channel-handle=1588 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
3128C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Skype /v RestartForUpdateC:\Windows\system32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
3988"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
2584"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=8AA684D97EFE6AA89E0BC120D743A2EB --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=1 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=8AA684D97EFE6AA89E0BC120D743A2EB --renderer-client-id=4 --mojo-platform-channel-handle=2336 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
2968"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
1328"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --disable-databases --service-pipe-token=AE4B6B263FA94965DC6F002C52CA99B3 --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\WebViewPreload.js" --guest-instance-id=1 --enable-blink-features --disable-blink-features --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=AE4B6B263FA94965DC6F002C52CA99B3 --renderer-client-id=6 --mojo-platform-channel-handle=2764 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
Total events
17 608
Read events
17 507
Write events
99
Delete events
2

Modification events

(PID) Process:(2972) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
rundll32.exe
(PID) Process:(3096) reg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Skype for Desktop
Value:
C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
(PID) Process:(3848) Skype.exeKey:HKEY_CLASSES_ROOT\skype
Operation:writeName:URL Protocol
Value:
(PID) Process:(3848) Skype.exeKey:HKEY_CLASSES_ROOT\skype
Operation:writeName:(default)
Value:
URL:skype
(PID) Process:(3848) Skype.exeKey:HKEY_CLASSES_ROOT\skype\shell\open\command
Operation:writeName:(default)
Value:
"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" -- "%1"
(PID) Process:(3848) Skype.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1592) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1592) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1592) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1592) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
Executable files
0
Suspicious files
214
Text files
126
Unknown types
15

Dropped files

PID
Process
Filename
Type
3848Skype.exeC:\Users\admin\AppData\Local\Temp\90eb000d-bd92-454b-8af8-6d911e38fcdf.tmp.ico —
MD5:—
SHA256:—
3848Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old —
MD5:—
SHA256:—
3848Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old —
MD5:—
SHA256:—
3848Skype.exeC:\Users\admin\AppData\Local\Temp\4bdd2e2f-5539-4d32-8aed-e24a9d354b4d.tmp.ico —
MD5:—
SHA256:—
1592chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6287EDAE-638.pma —
MD5:—
SHA256:—
3988Skype.exeC:\Users\admin\AppData\Local\Temp\skype-preview Crashes\operation_log.txttext
MD5:A44146F538F2FBDF142598E74FC5B9D3
SHA256:309A37C7A8D70871A960DEA764F8BD88A3597ED3D9174DC32DC30430D7A93C31
3048Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-2910902016.blogbinary
MD5:41E3AE70C43E2D4420F515C77C9C1EBE
SHA256:F8F8D0AB381FBA538B6F1B7573317A0819944D7FFC5F60307BBE0B92EBEB3B3C
3848Skype.exeC:\Users\admin\AppData\Local\Temp\90eb000d-bd92-454b-8af8-6d911e38fcdf.tmpimage
MD5:75A3D7765F2F4F8712775B10E1D18003
SHA256:28854F198091126B6E3A57FE312A3B77C1074CD0B111AED6F7604A2467F52166
3848Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b916037c1e115fe0.customDestinations-msbinary
MD5:7338DC2E2743DB01858FF3A3FE1D0659
SHA256:6DA6B8F73F55E0846C7B9BF005F36B54BC22E4D1372B57C6945935465DBC5985
3848Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1QO7DNX4QXUE22ZVJH1S.tempbinary
MD5:7338DC2E2743DB01858FF3A3FE1D0659
SHA256:6DA6B8F73F55E0846C7B9BF005F36B54BC22E4D1372B57C6945935465DBC5985
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
84
DNS requests
64
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2576
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
2576
chrome.exe
GET
200
2.16.107.82:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e4158fa950820914
unknown
compressed
60.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3848
Skype.exe
13.107.42.16:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
3848
Skype.exe
40.126.32.136:443
login.live.com
Microsoft Corporation
US
suspicious
2576
chrome.exe
142.250.185.228:443
www.google.com
Google Inc.
US
whitelisted
2576
chrome.exe
216.58.212.174:443
clients2.google.com
Google Inc.
US
whitelisted
2576
chrome.exe
142.250.185.77:443
accounts.google.com
Google Inc.
US
suspicious
—
—
192.229.221.185:443
logincdn.msauth.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3848
Skype.exe
192.229.221.185:443
logincdn.msauth.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3848
Skype.exe
152.199.19.160:443
bot-framework.azureedge.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3848
Skype.exe
104.102.28.183:443
download.skype.com
Akamai Technologies, Inc.
US
unknown
3848
Skype.exe
13.107.43.16:443
a.config.skype.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
get.skype.com
  • 52.174.193.75
whitelisted
a.config.skype.com
  • 13.107.43.16
whitelisted
pipe.skype.com
  • 13.89.178.26
whitelisted
download.skype.com
  • 104.102.28.183
whitelisted
bot-framework.azureedge.net
  • 152.199.19.160
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.134
  • 20.190.160.22
  • 20.190.160.20
  • 40.126.32.138
  • 20.190.160.17
  • 20.190.160.14
whitelisted
logincdn.msauth.net
  • 192.229.221.185
whitelisted
accounts.google.com
  • 142.250.185.77
shared
www.google.com
  • 142.250.185.228
whitelisted

Threats

No threats detected
Process
Message
Skype.exe
[3464:3476:0520/203557.767:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3464:3476:0520/203557.767:VERBOSE1:crash_service.cc(145)] window handle is 0003012A
Skype.exe
[3464:3476:0520/203557.767:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[3464:3476:0520/203557.767:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[3464:3476:0520/203557.767:VERBOSE1:crash_service_main.cc(94)] Ready to process crash requests
Skype.exe
[3464:2756:0520/203557.767:VERBOSE1:crash_service.cc(333)] client start. pid = 3848
Skype.exe
[3464:2756:0520/203559.844:VERBOSE1:crash_service.cc(333)] client start. pid = 3048
Skype.exe
[3988:4000:0520/203559.912:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3988:4000:0520/203559.917:VERBOSE1:crash_service.cc(145)] window handle is 0001014C
Skype.exe
[3988:4000:0520/203559.917:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Screenshot.jpg