File name:

SpyHunter-Installer.exe

Full analysis: https://app.any.run/tasks/a2631db6-0463-4402-a9c3-320681b3a23a
Verdict: Malicious activity
Analysis date: November 29, 2023, 16:23:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

07386184C9F3AB2B533C73C854398805

SHA1:

ED43D9745C5F8F91CF90003647CA983D7E0B037E

SHA256:

87996CC12B3919FB370A67E45B037E0B75F1DE66DF8AFCCA060F0AC8E3464910

SSDEEP:

98304:9s0KZREPHkflH97C10EjyK3f9dxWz4b+bZUiOkatCUBNBXoVY7LgCbuOqfyjXEvP:TMQNX1/N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • SpyHunter-Installer.exe (PID: 2684)

    • Drops the executable file immediately after the start

      • SpyHunter-Installer.exe (PID: 2684)
      • ShKernel.exe (PID: 2940)

    • Actions looks like stealing of personal data

      • SpyHunter5.exe (PID: 1360)

    • Steals credentials from Web Browsers

      • SpyHunter5.exe (PID: 1360)

    • Creates a writable file in the system directory

      • ShKernel.exe (PID: 2940)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • SpyHunter-Installer.exe (PID: 2684)
      • SpyHunter5.exe (PID: 1360)

    • Starts SC.EXE for service management

      • SpyHunter-Installer.exe (PID: 2684)

    • The process executes via Task Scheduler

      • rundll32.exe (PID: 3172)

    • Reads the Internet Settings

      • rundll32.exe (PID: 3172)

    • Executes as Windows Service

      • ShKernel.exe (PID: 2940)
      • ShMonitor.exe (PID: 3188)

    • Reads the Windows owner or organization settings

      • ShKernel.exe (PID: 2940)
      • SpyHunter5.exe (PID: 1360)

    • Creates files in the driver directory

      • ShKernel.exe (PID: 2940)

    • Drops a system driver (possible attempt to evade defenses)

      • ShKernel.exe (PID: 2940)

  • INFO

    • Checks supported languages

      • SpyHunter-Installer.exe (PID: 2684)
      • wmpnscfg.exe (PID: 3120)
      • ShKernel.exe (PID: 2940)
      • ShMonitor.exe (PID: 3188)
      • SpyHunter5.exe (PID: 1360)

    • Reads the computer name

      • SpyHunter-Installer.exe (PID: 2684)
      • wmpnscfg.exe (PID: 3120)
      • ShKernel.exe (PID: 2940)
      • ShMonitor.exe (PID: 3188)
      • SpyHunter5.exe (PID: 1360)

    • Create files in a temporary directory

      • SpyHunter-Installer.exe (PID: 2684)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3120)
      • msedge.exe (PID: 3532)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3120)

    • Application launched itself

      • msedge.exe (PID: 3656)
      • msedge.exe (PID: 3532)

    • Creates files in the program directory

      • SpyHunter-Installer.exe (PID: 2684)
      • ShKernel.exe (PID: 2940)
      • ShMonitor.exe (PID: 3188)
      • SpyHunter5.exe (PID: 1360)

    • Reads Windows Product ID

      • ShKernel.exe (PID: 2940)
      • SpyHunter5.exe (PID: 1360)

    • Reads CPU info

      • ShKernel.exe (PID: 2940)
      • SpyHunter5.exe (PID: 1360)

    • Process checks are UAC notifies on

      • ShKernel.exe (PID: 2940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (18)
.exe | Win32 Executable (generic) (2.9)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:03:22 07:53:32+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4718080
InitializedDataSize: 2381824
UninitializedDataSize: -
EntryPoint: 0x2a3117
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.0.822.5169
ProductVersionNumber: 3.0.822.5169
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: EnigmaSoft Limited
FileDescription: EnigmaSoft Installer
FileVersion: 3.0.822.5169
InternalName: Installer.exe
LegalCopyright: Copyright 2016-2023. EnigmaSoft Limited. All rights reserved.
OriginalFileName: Installer.exe
ProductName: Installer
ProductVersion: 3.0.822.5169
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
32
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start spyhunter-installer.exe wmpnscfg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs sc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs sc.exe no specs msedge.exe no specs msedge.exe regsvr32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sc.exe no specs shkernel.exe sc.exe no specs shmonitor.exe no specs msedge.exe no specs msedge.exe no specs spyhunter5.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs spyhunter-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
608"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1360"C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe" /hideC:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
ShKernel.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
MEDIUM
Description:
SpyHunter product.
Exit code:
0
Version:
5.15.13.318
Modules
Images
c:\program files\enigmasoft\spyhunter\spyhunter5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
1460"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=832 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1848"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3868 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2112C:\Windows\System32\sc.exe create ShMonitor start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe\"" DisplayName= "SpyHunter 5 Kernel Monitor"C:\Windows\System32\sc.exe—SpyHunter-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2468"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3528 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2492C:\Windows\System32\sc.exe description ShMonitor "SpyHunter 5 Kernel Monitor"C:\Windows\System32\sc.exe—SpyHunter-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2540"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1624 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2636"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2616 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2684"C:\Users\admin\AppData\Local\Temp\SpyHunter-Installer.exe" C:\Users\admin\AppData\Local\Temp\SpyHunter-Installer.exe
explorer.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
HIGH
Description:
EnigmaSoft Installer
Exit code:
0
Version:
3.0.822.5169
Modules
Images
c:\users\admin\appdata\local\temp\spyhunter-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
80 306
Read events
80 273
Write events
30
Delete events
3

Modification events

(PID) Process:(3120) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{FFD3C2F6-7A43-453A-9472-5F51F8221939}\{93363BAE-617C-4418-B52D-0FD8F6D0F152}
Operation:delete keyName:(default)
Value:
(PID) Process:(3120) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{FFD3C2F6-7A43-453A-9472-5F51F8221939}
Operation:delete keyName:(default)
Value:
(PID) Process:(3120) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{513A9FD7-4F03-4D52-8205-EC4A88D35954}
Operation:delete keyName:(default)
Value:
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
1
(PID) Process:(3656) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
8A1A1F2B695E2F00
Executable files
13
Suspicious files
129
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exeexecutable
MD5:7FFAE646AFCF1CBFEFAFCEBA4C67B875
SHA256:5ACB945E83D19C1880636585692B611A237928B2B1D7E0DAAE0F92BB6DFB3760
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\WebSecurityNative.exeexecutable
MD5:D3D61F1A7B0AA4FC727AA9FCC99B212D
SHA256:25B4A1A46CA61DE666CD03554DB31AAC51482852030B277B057782D1983D4FD4
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\purl.datbinary
MD5:7AA170A1F3DE6CDDD1C78E01350A761F
SHA256:FD6E3AF645C449953F15FAC8F692CB6C5A557D060BA251F7938D322183830ED6
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lngbinary
MD5:628865B3F840AE7472B5370B7D966C88
SHA256:4D135B33ED493A82B1D8FDEA10D380E3C8A4FA0D92D4CEC2B60924CA931989C3
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exeexecutable
MD5:5BD80C7905A34E2884F569C2B3F2FA19
SHA256:A9952C0B38FC4BD516DA5CC42259000FB2A720479C9733C915815329EA882CA4
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lngbinary
MD5:D98599F9AA69931757714AF8B4B63DFC
SHA256:44A424936C68DB1AD7D03C9FAFCAE56E0C042BD58C903863D57A5DB5C4A97313
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\license.txttext
MD5:66507057FFDF4CAF36C3061C80D2D08F
SHA256:A80E70A5E036EAC0C75354D4EE0E4147D606DEBBDDB704435C96CF2DE2C8C777
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Native.exeexecutable
MD5:FE5C15C1D2083D3698C2C7561C9D4B85
SHA256:A781AE4663682A759754730721EB72C16422AA6F0CA1D53D00A7516F797216B3
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exeexecutable
MD5:195E804929EC92FCAB0109A3A5525403
SHA256:671BA292CA8BFF9B644B1EF645EF7FE6A3E2B50C7A11AF52F0DB1F4CFFBC7133
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lngbinary
MD5:B9D5C36DDF344822C6A2C846CE35965B
SHA256:27B4003B5DC0855BCFA883D20F2F2C870D7594AB8C6F5048582ECB66549C4C0C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
132
DNS requests
104
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2684
SpyHunter-Installer.exe
GET
301
169.150.247.38:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.mbr.ecf
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.38:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_vmlinuz.ecf
unknown
html
162 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d3beddd762d67162
unknown
compressed
4.66 Kb
unknown
2684
SpyHunter-Installer.exe
HEAD
200
142.250.186.36:80
http://www.google.com/
unknown
—
—
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.38:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_initrd.gz.ecf
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.39:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.ecf
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.39:80
http://installer.enigmasoftware.com/log_collect.cfg
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.39:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.ecf
unknown
html
162 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2684
SpyHunter-Installer.exe
65.9.95.104:443
geo-ip.enigmasoft.net
AMAZON-02
US
unknown
2684
SpyHunter-Installer.exe
216.58.206.46:443
www.google-analytics.com
GOOGLE
US
whitelisted
2684
SpyHunter-Installer.exe
142.250.186.36:80
www.google.com
GOOGLE
US
whitelisted
2684
SpyHunter-Installer.exe
169.150.247.39:80
installer.enigmasoftware.com
—
GB
unknown
2684
SpyHunter-Installer.exe
169.150.247.39:443
installer.enigmasoftware.com
—
GB
unknown
2684
SpyHunter-Installer.exe
65.9.95.41:443
dl.enigmasoftware.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
geo-ip.enigmasoft.net
  • 65.9.95.104
  • 65.9.95.8
  • 65.9.95.15
  • 65.9.95.31
  • 18.239.18.65
  • 18.239.18.126
  • 18.239.18.38
  • 18.239.18.49
unknown
www.google-analytics.com
  • 216.58.206.46
  • 142.250.185.206
whitelisted
www.google.com
  • 142.250.186.36
  • 142.250.185.68
whitelisted
installer.enigmasoftware.com
  • 169.150.247.39
  • 169.150.247.38
shared
dl.enigmasoftware.com
  • 65.9.95.41
  • 65.9.95.59
  • 65.9.95.78
  • 65.9.95.75
whitelisted
instcfg.enigmasoftware.com
  • 65.9.95.10
  • 65.9.95.129
  • 65.9.95.97
  • 65.9.95.36
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.31.251.109
whitelisted
www.enigmasoftware.com
  • 13.227.219.88
  • 13.227.219.87
  • 13.227.219.23
  • 13.227.219.33
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted

Threats

No threats detected
Process
Message
ShKernel.exe
Main. Enter. Initializing logger...
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpyHunter-Installer.exe