Hi Folks,
I am receiving an unusual (in my mind) report from insight on a file called "SkypeHost.exe". While it is rated as a trust level good, it has been out for less than a week and is used by less then 5 community members (text report to follow this explanation since pasting a screen shot seems near impossible in this editor). Now my thinking is if this is a legitimate Skype product, it would be seen by hundreds of thousands of users, but if it is malware, it would not be trusted. VirusTotal does not have any detections for it (ie, it reports clean there). Is it possible that this is legit / Microsoft has 'customized' this Skype file with some personal / unique info making it fail to match other installations?
For what it is worth, I am having a similar issue with "winstore.app.exe", which only appears to kick off when I (legitimately) launch the Windows store application.
Both files pass the Norton signature scan with flying colours.
Any thoughts?
Thank you!
Filename: SkypeHost.exe
Full Path: C:\Program Files\WindowsApps\microsoft.skypeapp_11.9.251.0_x64__kzf8qxf38zg5c\SkypeHost.exe
____________________________
____________________________
Developers
Not Available
Version
11.9.251.0
Identified
11/6/2016 at 9:45:43 AM
Last Used
11/6/2016 at 11:09:33 AM
Startup Item
Yes
____________________________
Very Few Users
Fewer than 5 users in the Norton Community have used this file.
Very New
This file was released less than 1 week ago.
Good
Norton has given this file a favorable rating.
____________________________
Source File:
skypehost.exe
File Thumbprint - SHA:
3f66406ace259e2ead6fa1463b5d272b0d8c6c41cb94a6129dcb527b7081ebc6
File Thumbprint - MD5:
333ff5a1258010d9e3fd9b37dc578640
**************************
Filename: winstore.app.exe
Full Path: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11610.1001.10.0_x64__8wekyb3d8bbwe\WinStore.App.exe
____________________________
____________________________
Developers
Not Available
Version
11610.1001.10.0
Identified
11/4/2016 at 12:18:02 AM
Last Used
11/6/2016 at 11:22:24 AM
Startup Item
Yes
____________________________
Very Few Users
Fewer than 5 users in the Norton Community have used this file.
Very New
This file was released less than 1 week ago.
Good
Norton has given this file a favorable rating.
____________________________
Source File:
svchost.exe
File Created:
winstore.app.exe
____________________________
Performance
____________________________
Avg. Resource Usage: Low
Avg. CPU Usage: Low
Avg. Memory Usage: Low
____________________________
Performance Alert
Process ID
14124
CPU
Normal
Memory
Normal
Handles Count
Normal
Disk Read Activity
Normal
Disk Write Activity
Normal
____________________________
File Thumbprint - SHA:
59fa1e8d35152632f7683c033f40b78c91ce97e1322e59227591b1ab03a82308
File Thumbprint - MD5:
da8caeda8d6fe7bd5267380f8f3854e1