File name:

SkyVPNSetup-official.exe

Full analysis: https://app.any.run/tasks/31fd2864-c6c3-4030-af84-229a754a1ef3
Verdict: Malicious activity
Analysis date: February 13, 2024, 21:49:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

66056B58020EDE859C4A55F353385B56

SHA1:

6C736CBEB439A12A75BC966175A2C4375426C231

SHA256:

F770862FD4F2AE86D66E9D6768A17BCDF0F85CAB09B5F27475F865E5710F2D68

SSDEEP:

196608:+w5KLjH4osXZQepRFP7m//zarN9Nt+4yb4hNQhoPt4lVniJo65iMQkt:+wCjHQXOepRd6Xzah9Nt0b4bQuPwY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SkyVPNSetup-official.exe (PID: 3944)
      • SkyVPNSetup-official.tmp (PID: 3228)
      • tap-windows-9.21.2.exe (PID: 3964)
      • tapinstall.exe (PID: 2792)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)

    • Changes the autorun value in the registry

      • drvinst.exe (PID: 2576)
      • SkyVPNSetup-official.tmp (PID: 3228)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SkyVPNSetup-official.exe (PID: 3944)
      • SkyVPNSetup-official.tmp (PID: 3228)
      • tap-windows-9.21.2.exe (PID: 3964)
      • tapinstall.exe (PID: 2792)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)

    • Reads the Windows owner or organization settings

      • SkyVPNSetup-official.tmp (PID: 3228)

    • Adds/modifies Windows certificates

      • CertMgr.Exe (PID: 1696)
      • CertMgr.Exe (PID: 120)
      • tapinstall.exe (PID: 2792)

    • Process drops legitimate windows executable

      • SkyVPNSetup-official.tmp (PID: 3228)

    • The process drops C-runtime libraries

      • SkyVPNSetup-official.tmp (PID: 3228)

    • Drops a system driver (possible attempt to evade defenses)

      • SkyVPNSetup-official.tmp (PID: 3228)
      • tap-windows-9.21.2.exe (PID: 3964)
      • tapinstall.exe (PID: 2792)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)

    • The process creates files with name similar to system file names

      • tap-windows-9.21.2.exe (PID: 3964)

    • Starts application with an unusual extension

      • tap-windows-9.21.2.exe (PID: 3964)

    • Reads security settings of Internet Explorer

      • tapinstall.exe (PID: 2792)
      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Reads settings of System Certificates

      • tapinstall.exe (PID: 2792)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • tap-windows-9.21.2.exe (PID: 3964)

    • Checks Windows Trust Settings

      • tapinstall.exe (PID: 2792)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)

    • Creates files in the driver directory

      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2184)

    • Creates a software uninstall entry

      • tap-windows-9.21.2.exe (PID: 3964)

    • Searches for installed software

      • SkyVPNSetup-official.tmp (PID: 3228)
      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Process uses IPCONFIG to clear DNS cache

      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Reads the Internet Settings

      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Suspicious use of NETSH.EXE

      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Detected use of alternative data streams (AltDS)

      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Connects to unusual port

      • skyvpn.exe (PID: 1232)

  • INFO

    • Checks supported languages

      • SkyVPNSetup-official.exe (PID: 3944)
      • CertMgr.Exe (PID: 120)
      • SkyVPNSetup-official.tmp (PID: 3228)
      • tap-windows-9.21.2.exe (PID: 3964)
      • CertMgr.Exe (PID: 1696)
      • nsA862.tmp (PID: 3940)
      • tapinstall.exe (PID: 2892)
      • nsA8E0.tmp (PID: 2756)
      • tapinstall.exe (PID: 2792)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)
      • wmpnscfg.exe (PID: 3524)
      • wmpnscfg.exe (PID: 1956)
      • wmpnscfg.exe (PID: 3396)
      • wmpnscfg.exe (PID: 1040)
      • wmpnscfg.exe (PID: 2408)
      • wmpnscfg.exe (PID: 1768)
      • wmpnscfg.exe (PID: 1924)
      • wmpnscfg.exe (PID: 2384)
      • wmpnscfg.exe (PID: 3312)
      • wmpnscfg.exe (PID: 2768)
      • skyvpn.exe (PID: 3320)
      • wmpnscfg.exe (PID: 3788)
      • wmpnscfg.exe (PID: 3180)
      • skyvpn.exe (PID: 1232)

    • Reads the computer name

      • SkyVPNSetup-official.tmp (PID: 3228)
      • tapinstall.exe (PID: 2792)
      • tap-windows-9.21.2.exe (PID: 3964)
      • tapinstall.exe (PID: 2892)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)
      • skyvpn.exe (PID: 1232)
      • wmpnscfg.exe (PID: 3524)
      • wmpnscfg.exe (PID: 3396)
      • wmpnscfg.exe (PID: 1956)
      • wmpnscfg.exe (PID: 1040)
      • wmpnscfg.exe (PID: 2408)
      • wmpnscfg.exe (PID: 1768)
      • wmpnscfg.exe (PID: 2384)
      • wmpnscfg.exe (PID: 1924)
      • wmpnscfg.exe (PID: 3312)
      • wmpnscfg.exe (PID: 2768)
      • skyvpn.exe (PID: 3320)
      • wmpnscfg.exe (PID: 3788)
      • wmpnscfg.exe (PID: 3180)

    • Reads the machine GUID from the registry

      • SkyVPNSetup-official.tmp (PID: 3228)
      • tapinstall.exe (PID: 2792)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)
      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Create files in a temporary directory

      • SkyVPNSetup-official.exe (PID: 3944)
      • SkyVPNSetup-official.tmp (PID: 3228)
      • tap-windows-9.21.2.exe (PID: 3964)
      • tapinstall.exe (PID: 2792)
      • skyvpn.exe (PID: 3320)

    • Creates files in the program directory

      • SkyVPNSetup-official.tmp (PID: 3228)
      • tap-windows-9.21.2.exe (PID: 3964)

    • Creates a software uninstall entry

      • SkyVPNSetup-official.tmp (PID: 3228)

    • Reads the software policy settings

      • tapinstall.exe (PID: 2792)
      • drvinst.exe (PID: 2168)
      • drvinst.exe (PID: 2576)

    • Reads Environment values

      • drvinst.exe (PID: 2576)

    • Creates files or folders in the user directory

      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Process checks computer location settings

      • skyvpn.exe (PID: 1232)
      • skyvpn.exe (PID: 3320)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1956)
      • wmpnscfg.exe (PID: 3396)
      • wmpnscfg.exe (PID: 3524)
      • wmpnscfg.exe (PID: 1040)
      • wmpnscfg.exe (PID: 2408)
      • wmpnscfg.exe (PID: 1924)
      • wmpnscfg.exe (PID: 2384)
      • wmpnscfg.exe (PID: 1768)
      • wmpnscfg.exe (PID: 3312)
      • wmpnscfg.exe (PID: 2768)
      • skyvpn.exe (PID: 3320)
      • skyvpn.exe (PID: 3204)
      • wmpnscfg.exe (PID: 3180)
      • wmpnscfg.exe (PID: 3788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 28160
UninitializedDataSize: -
EntryPoint: 0x9c14
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2022.5.26.222
ProductVersionNumber: 2022.5.26.222
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Talktone, Inc.
FileDescription: SkyVPN Setup
FileVersion: 2022.05.26.222
LegalCopyright: Copyright 2019 Talktone,Inc.
ProductName: SkyVPN
ProductVersion: 0.9.27
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
53
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start skyvpnsetup-official.exe skyvpnsetup-official.tmp certmgr.exe no specs certmgr.exe no specs tap-windows-9.21.2.exe nsa862.tmp no specs tapinstall.exe no specs nsa8e0.tmp no specs tapinstall.exe drvinst.exe vssvc.exe no specs drvinst.exe skyvpn.exe ipconfig.exe no specs netsh.exe wmpnscfg.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs wmpnscfg.exe no specs netsh.exe wmpnscfg.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs wmpnscfg.exe no specs netsh.exe wmpnscfg.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs wmpnscfg.exe no specs netsh.exe wmpnscfg.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs wmpnscfg.exe no specs netsh.exe wmpnscfg.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs wmpnscfg.exe no specs skyvpn.exe no specs skyvpn.exe netsh.exe wmpnscfg.exe no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs wmpnscfg.exe no specs skyvpnsetup-official.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\SkyVPN\driver\certmgr.exe" -add -c "C:\Program Files\SkyVPN\driver\openvpn-sha1.cer" -s -r localMachine trustedpublisherC:\Program Files\SkyVPN\driver\CertMgr.Exe—SkyVPNSetup-official.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
ECM Certificate Manager
Exit code:
0
Version:
6.0.6001.17131 (longhorn_rtm.080108-2300)
Modules
Images
c:\program files\skyvpn\driver\certmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
268netsh interface ip set subinterface "18" mtu=1180C:\Windows\System32\netsh.exe—skyvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
844"C:\Windows\System32\ipconfig.exe" /flushdnsC:\Windows\System32\ipconfig.exe—skyvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
1040"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1172"C:\Windows\System32\ipconfig.exe" /flushdnsC:\Windows\System32\ipconfig.exe—skyvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
1216"C:\Windows\System32\ipconfig.exe" /flushdnsC:\Windows\System32\ipconfig.exe—skyvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
1232"C:\Program Files\SkyVPN\skyvpn.exe"C:\Program Files\SkyVPN\skyvpn.exe
SkyVPNSetup-official.tmp
User:
admin
Company:
Talktone
Integrity Level:
HIGH
Description:
SkyVPN
Exit code:
0
Version:
2022.05.26.222
Modules
Images
c:\program files\skyvpn\skyvpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\skyvpn\log4cxx.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\odbc32.dll
1604"C:\Windows\System32\ipconfig.exe" /flushdnsC:\Windows\System32\ipconfig.exe—skyvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
1612netsh interface ip set dnsservers "18" static 8.8.8.8C:\Windows\System32\netsh.exe
skyvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1696"C:\Program Files\SkyVPN\driver\certmgr.exe" -add -c "C:\Program Files\SkyVPN\driver\openvpn-sha256.cer" -s -r localMachine trustedpublisherC:\Program Files\SkyVPN\driver\CertMgr.Exe—SkyVPNSetup-official.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
ECM Certificate Manager
Exit code:
0
Version:
6.0.6001.17131 (longhorn_rtm.080108-2300)
Modules
Images
c:\program files\skyvpn\driver\certmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
65 435
Read events
64 233
Write events
1 135
Delete events
67

Modification events

(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
9C0C000016403983C65EDA01
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
C1C9884FFB707089F7E03D778717AB0817B3C971584C96F5C2046A4B66037DD0
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\SkyVPN\skyvpn.exe
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
F4081E2085E673E560089111E815C9DD5FE29666D2E314DBA45B0FEC72EEBBFC
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{822796AC-24D2-4DE2-939B-CE3531305189}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.1.ee2 (a)
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{822796AC-24D2-4DE2-939B-CE3531305189}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\SkyVPN
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{822796AC-24D2-4DE2-939B-CE3531305189}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\SkyVPN\
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{822796AC-24D2-4DE2-939B-CE3531305189}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(3228) SkyVPNSetup-official.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{822796AC-24D2-4DE2-939B-CE3531305189}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
83
Suspicious files
27
Text files
786
Unknown types
13

Dropped files

PID
Process
Filename
Type
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\libeay32.dllexecutable
MD5:29E27E91C2031FEBAFA594012C433A86
SHA256:179CCDA05DCF8925D2E060412743EE8865AAD8AA1EB3BF59BAF8FB9BFEAC248B
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\msvcr120.dllexecutable
MD5:6A14BBAEA1CC14C2DCF8B67DF97D0D75
SHA256:A3F5330A6AA9E1E6220934381689E52729EBA5FE41D9FA1C289F4E80F1948C6F
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\ssleay32.dllexecutable
MD5:6490F6B847BD4793EE61C88193DD3000
SHA256:39B7FA44B5E9816076A9A592124E663D107C220A38C1471FF7BFA0F331C8AC88
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\btn_option.pngimage
MD5:E3D714F9973466E2741B7647585E0E69
SHA256:457F930D38F837539A35D2A14437F782F20AA05752A603F0B052FB1079E92E3E
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\rpt.dllexecutable
MD5:7AE1430D4E741F499B2E0D9ABB0DE96D
SHA256:444D59D4240E61170DE3249E481A7572384E7BE9E3478728CDC8267EAED7196B
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\bg_welcome.pngimage
MD5:67BF5E47DAF72F36FB1D6096FFE37982
SHA256:76BF39705F49B7AA532AC2A0A0562EAE9C4BDE6FEDF9A00738E11D25BD09EDDA
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\btn_min.pngimage
MD5:A8C2560BD0FCAF90AA2FE15F4E1D6D23
SHA256:841346B7577C04BF325029A8477DBB42303AABA90498ABC03147A77D9AC3C9CC
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\libcurl.dllexecutable
MD5:5D621E1D4B39CC514BEA3668DEED99E8
SHA256:0FA9C134FE51D24934477E420285EC195619247BFBF2D5A465ECFDE33CA2D0BF
3228SkyVPNSetup-official.tmpC:\Users\admin\AppData\Local\Temp\is-UNUQV.tmp\botva2.dllexecutable
MD5:DD01877C71F8DBCBDD5C2A351F1D7EA7
SHA256:209EDEF5F6DDFEB93B710426A9E60E7C291A50B338FF6701475727CA60D2A9FC
3944SkyVPNSetup-official.exeC:\Users\admin\AppData\Local\Temp\is-17AJI.tmp\SkyVPNSetup-official.tmpexecutable
MD5:83486A64D3B1B6BEDE392ED2450AD0CC
SHA256:E2002DAFFF5CD785027118BFAA2A0366A6ACCEB1776D221B544F5B8358727BFC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
68
TCP/UDP connections
427
DNS requests
42
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1232
skyvpn.exe
GET
—
159.89.246.204:80
http://spanish.academy/
unknown
—
—
unknown
1232
skyvpn.exe
GET
—
143.244.203.155:80
http://classcraft.com/
unknown
—
—
unknown
1232
skyvpn.exe
GET
—
143.244.203.155:80
http://classcraft.com/
unknown
—
—
unknown
1232
skyvpn.exe
GET
—
159.89.246.204:80
http://spanish.academy/
unknown
—
—
unknown
1232
skyvpn.exe
GET
—
165.227.220.117:80
http://spanish.academy/
unknown
—
—
unknown
1232
skyvpn.exe
GET
—
161.35.176.156:80
http://questclubs.net/
unknown
—
—
unknown
1232
skyvpn.exe
GET
—
134.122.117.239:80
http://www.movingbeyondthepage.com/
unknown
—
—
unknown
1232
skyvpn.exe
GET
—
68.183.152.115:80
http://characterfirsteducation.com/
unknown
—
—
unknown
1232
skyvpn.exe
GET
200
104.131.181.82:80
http://www.educents.com/
unknown
binary
423 b
unknown
1232
skyvpn.exe
GET
—
137.184.97.171:80
http://www.ixl.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3228
SkyVPNSetup-official.tmp
143.204.205.164:443
d1u61jvzmljc3v.cloudfront.net
AMAZON-02
US
unknown
3228
SkyVPNSetup-official.tmp
143.204.205.61:443
d1u61jvzmljc3v.cloudfront.net
AMAZON-02
US
unknown
1232
skyvpn.exe
13.224.98.218:443
d1qji4igqoqucw.cloudfront.net
AMAZON-02
US
whitelisted
1232
skyvpn.exe
159.89.246.204:18869
—
—
—
unknown
1232
skyvpn.exe
143.244.203.155:32297
—
—
—
unknown
1232
skyvpn.exe
45.55.97.71:10547
—
—
—
unknown
1232
skyvpn.exe
165.227.220.117:53239
—
—
—
unknown

DNS requests

Domain
IP
Reputation
d1u61jvzmljc3v.cloudfront.net
  • 143.204.205.164
  • 143.204.205.151
  • 143.204.205.178
  • 143.204.205.61
whitelisted
d1qji4igqoqucw.cloudfront.net
  • 13.224.98.218
  • 13.224.98.53
  • 13.224.98.78
  • 13.224.98.98
whitelisted
www.microsoft.com
  • —
unknown
dm46l3i5mnhr0.cloudfront.net
  • 13.224.103.102
  • 13.224.103.43
  • 13.224.103.122
  • 13.224.103.75
whitelisted
6to4.ipv6.microsoft.com
  • 192.88.99.1
whitelisted
www.google.com
  • 172.217.16.132
whitelisted
dt-apigateway-log.dt-pn1.com
  • 18.165.183.72
  • 18.165.183.16
  • 18.165.183.54
  • 18.165.183.57
unknown

Threats

PID
Process
Class
Message
1232
skyvpn.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] A SSH banner has been detected on a non-standard port number
Process
Message
skyvpn.exe
21:50:23.950-T1:[Keyfo]------------------------------Jucontext_t start(release) at Windows-----------------------------------
skyvpn.exe
21:50:23.950-T1:[Keyfo]Jucontext_t::Jucontext_t,context(id=0,sdk_version=0,and bin_version=1) start from thread(2)
skyvpn.exe
21:50:23.950-T1:[Keyfo]------------xclient release build(ver:1.3.5) at local date and time: Jan 4 2022 11:29:53 ------------
skyvpn.exe
21:50:23.950-T1:[Keyfo]>>>>>>>>>>> (xclient start at time of gmt(2024-2-13 21:50:23) vs local(2024-2-13 21:50:23),time ticks(1629515) <<<<<<<<<<<<<<<
skyvpn.exe
21:50:23.950-T1:[Keyfo]Jucontext::start,current status=0,site_id=0,subsite_id=0,node_id=0,process_id=0
skyvpn.exe
21:50:23.950-T1:[Keyfo]Jucontext::start,init_thread type=16 with count=1,wait_thread_to_started=1
skyvpn.exe
21:50:23.950-T1:[Keyfo]Juthread_base::Juthread_base,this(27853960) ,execute_thread(1), host-thread-id(0),cond_size=96 and cond_offset=8
skyvpn.exe
21:50:23.950-T1:[Keyfo]Jumailbox_t::Jumailbox_t,this=27842256,objectid(72057594037927937) at status(1),thread_id(0)
skyvpn.exe
21:50:23.950-T1:[Keyfo]Jusignaler_t::Jusignaler_t,m_w_handle(796).send_buffer(8192) and m_r_handle(804).recv_buffer(8192),object_id=72057594037927938
skyvpn.exe
21:50:23.950-T1:[Keyfo]Jusignaler_t::Jusignaler_t,m_w_handle(808).send_buffer(8192) and m_r_handle(812).recv_buffer(8192),object_id=72057594037927939
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SkyVPNSetup-official.exe