File name:

SpyHunter-Installer.exe

Full analysis: https://app.any.run/tasks/a2631db6-0463-4402-a9c3-320681b3a23a
Verdict: Malicious activity
Analysis date: November 29, 2023, 16:23:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

07386184C9F3AB2B533C73C854398805

SHA1:

ED43D9745C5F8F91CF90003647CA983D7E0B037E

SHA256:

87996CC12B3919FB370A67E45B037E0B75F1DE66DF8AFCCA060F0AC8E3464910

SSDEEP:

98304:9s0KZREPHkflH97C10EjyK3f9dxWz4b+bZUiOkatCUBNBXoVY7LgCbuOqfyjXEvP:TMQNX1/N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • SpyHunter-Installer.exe (PID: 2684)

    • Drops the executable file immediately after the start

      • SpyHunter-Installer.exe (PID: 2684)
      • ShKernel.exe (PID: 2940)

    • Actions looks like stealing of personal data

      • SpyHunter5.exe (PID: 1360)

    • Steals credentials from Web Browsers

      • SpyHunter5.exe (PID: 1360)

    • Creates a writable file in the system directory

      • ShKernel.exe (PID: 2940)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • SpyHunter-Installer.exe (PID: 2684)
      • SpyHunter5.exe (PID: 1360)

    • Starts SC.EXE for service management

      • SpyHunter-Installer.exe (PID: 2684)

    • Reads the Internet Settings

      • rundll32.exe (PID: 3172)

    • Executes as Windows Service

      • ShKernel.exe (PID: 2940)
      • ShMonitor.exe (PID: 3188)

    • The process executes via Task Scheduler

      • rundll32.exe (PID: 3172)

    • Reads the Windows owner or organization settings

      • ShKernel.exe (PID: 2940)
      • SpyHunter5.exe (PID: 1360)

    • Drops a system driver (possible attempt to evade defenses)

      • ShKernel.exe (PID: 2940)

    • Creates files in the driver directory

      • ShKernel.exe (PID: 2940)

  • INFO

    • Reads the computer name

      • SpyHunter-Installer.exe (PID: 2684)
      • wmpnscfg.exe (PID: 3120)
      • ShKernel.exe (PID: 2940)
      • ShMonitor.exe (PID: 3188)
      • SpyHunter5.exe (PID: 1360)

    • Checks supported languages

      • SpyHunter-Installer.exe (PID: 2684)
      • wmpnscfg.exe (PID: 3120)
      • ShKernel.exe (PID: 2940)
      • SpyHunter5.exe (PID: 1360)
      • ShMonitor.exe (PID: 3188)

    • Create files in a temporary directory

      • SpyHunter-Installer.exe (PID: 2684)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3120)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3120)
      • msedge.exe (PID: 3532)

    • Creates files in the program directory

      • SpyHunter-Installer.exe (PID: 2684)
      • ShKernel.exe (PID: 2940)
      • ShMonitor.exe (PID: 3188)
      • SpyHunter5.exe (PID: 1360)

    • Application launched itself

      • msedge.exe (PID: 3656)
      • msedge.exe (PID: 3532)

    • Reads CPU info

      • ShKernel.exe (PID: 2940)
      • SpyHunter5.exe (PID: 1360)

    • Reads Windows Product ID

      • ShKernel.exe (PID: 2940)
      • SpyHunter5.exe (PID: 1360)

    • Process checks are UAC notifies on

      • ShKernel.exe (PID: 2940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (18)
.exe | Win32 Executable (generic) (2.9)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:03:22 07:53:32+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4718080
InitializedDataSize: 2381824
UninitializedDataSize: -
EntryPoint: 0x2a3117
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.0.822.5169
ProductVersionNumber: 3.0.822.5169
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: EnigmaSoft Limited
FileDescription: EnigmaSoft Installer
FileVersion: 3.0.822.5169
InternalName: Installer.exe
LegalCopyright: Copyright 2016-2023. EnigmaSoft Limited. All rights reserved.
OriginalFileName: Installer.exe
ProductName: Installer
ProductVersion: 3.0.822.5169
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
32
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start spyhunter-installer.exe wmpnscfg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs sc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs sc.exe no specs msedge.exe no specs msedge.exe regsvr32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sc.exe no specs shkernel.exe sc.exe no specs shmonitor.exe no specs msedge.exe no specs msedge.exe no specs spyhunter5.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs spyhunter-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
608"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1360"C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe" /hideC:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
ShKernel.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
MEDIUM
Description:
SpyHunter product.
Exit code:
0
Version:
5.15.13.318
Modules
Images
c:\program files\enigmasoft\spyhunter\spyhunter5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
1460"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=832 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1848"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3868 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2112C:\Windows\System32\sc.exe create ShMonitor start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe\"" DisplayName= "SpyHunter 5 Kernel Monitor"C:\Windows\System32\sc.exe—SpyHunter-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2468"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3528 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2492C:\Windows\System32\sc.exe description ShMonitor "SpyHunter 5 Kernel Monitor"C:\Windows\System32\sc.exe—SpyHunter-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2540"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1624 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2636"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2616 --field-trial-handle=1248,i,11628443194905667024,11504403440594020553,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2684"C:\Users\admin\AppData\Local\Temp\SpyHunter-Installer.exe" C:\Users\admin\AppData\Local\Temp\SpyHunter-Installer.exe
explorer.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
HIGH
Description:
EnigmaSoft Installer
Exit code:
0
Version:
3.0.822.5169
Modules
Images
c:\users\admin\appdata\local\temp\spyhunter-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
80 306
Read events
80 273
Write events
30
Delete events
3

Modification events

(PID) Process:(3120) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{FFD3C2F6-7A43-453A-9472-5F51F8221939}\{93363BAE-617C-4418-B52D-0FD8F6D0F152}
Operation:delete keyName:(default)
Value:
(PID) Process:(3120) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{FFD3C2F6-7A43-453A-9472-5F51F8221939}
Operation:delete keyName:(default)
Value:
(PID) Process:(3120) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{513A9FD7-4F03-4D52-8205-EC4A88D35954}
Operation:delete keyName:(default)
Value:
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3656) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
1
(PID) Process:(3656) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
8A1A1F2B695E2F00
Executable files
13
Suspicious files
129
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lngbinary
MD5:B9D5C36DDF344822C6A2C846CE35965B
SHA256:27B4003B5DC0855BCFA883D20F2F2C870D7594AB8C6F5048582ECB66549C4C0C
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\license.txttext
MD5:66507057FFDF4CAF36C3061C80D2D08F
SHA256:A80E70A5E036EAC0C75354D4EE0E4147D606DEBBDDB704435C96CF2DE2C8C777
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lngbinary
MD5:D98599F9AA69931757714AF8B4B63DFC
SHA256:44A424936C68DB1AD7D03C9FAFCAE56E0C042BD58C903863D57A5DB5C4A97313
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lngbinary
MD5:628865B3F840AE7472B5370B7D966C88
SHA256:4D135B33ED493A82B1D8FDEA10D380E3C8A4FA0D92D4CEC2B60924CA931989C3
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exeexecutable
MD5:195E804929EC92FCAB0109A3A5525403
SHA256:671BA292CA8BFF9B644B1EF645EF7FE6A3E2B50C7A11AF52F0DB1F4CFFBC7133
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Dutch.lngbinary
MD5:5A51DE831DC4CE2053074C49E0C7D6FE
SHA256:466C6813903AC5F71B6736326072FAB152B050E0A990F3DB751D0B984E581C72
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\German.lngbinary
MD5:887588EB977DA81EE3FD696654729981
SHA256:CAB317C9029BA2AB24F3DD0D5D500156B375F232F8098C5F6E4985690C2376F2
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Bulgarian.lngbinary
MD5:53A8B62A59F9A78BB5B71645F1492CC5
SHA256:03554EF7687386EF534A86300784CAA288083E9C8D3141E4080087FB990A428B
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Albanian.lngbinary
MD5:DBE4F7096EDB8BFD0DEAC20F19C3C08A
SHA256:59D57CD9609A77E3C69E40048DDC1E27A81B28241F493DE0736899B28B6603C4
2684SpyHunter-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lngbinary
MD5:F6D0F51E315DDEF05355056E9190E68E
SHA256:1C5A4D7C73CCDB2BDDEA3ED512746D7928A5C0E82D58CC25ACC3628D64989548
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
132
DNS requests
104
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2684
SpyHunter-Installer.exe
HEAD
200
142.250.186.36:80
http://www.google.com/
unknown
—
—
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.39:80
http://installer.enigmasoftware.com/log_collect.cfg
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.39:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.ecf
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.38:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_vmlinuz.ecf
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.38:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_initrd.gz.ecf
unknown
html
162 b
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.38:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.mbr.ecf
unknown
html
162 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d3beddd762d67162
unknown
compressed
4.66 Kb
unknown
2684
SpyHunter-Installer.exe
GET
301
169.150.247.39:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.ecf
unknown
html
162 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2684
SpyHunter-Installer.exe
65.9.95.104:443
geo-ip.enigmasoft.net
AMAZON-02
US
unknown
2684
SpyHunter-Installer.exe
216.58.206.46:443
www.google-analytics.com
GOOGLE
US
whitelisted
2684
SpyHunter-Installer.exe
142.250.186.36:80
www.google.com
GOOGLE
US
whitelisted
2684
SpyHunter-Installer.exe
169.150.247.39:80
installer.enigmasoftware.com
—
GB
unknown
2684
SpyHunter-Installer.exe
169.150.247.39:443
installer.enigmasoftware.com
—
GB
unknown
2684
SpyHunter-Installer.exe
65.9.95.41:443
dl.enigmasoftware.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
geo-ip.enigmasoft.net
  • 65.9.95.104
  • 65.9.95.8
  • 65.9.95.15
  • 65.9.95.31
  • 18.239.18.65
  • 18.239.18.126
  • 18.239.18.38
  • 18.239.18.49
unknown
www.google-analytics.com
  • 216.58.206.46
  • 142.250.185.206
whitelisted
www.google.com
  • 142.250.186.36
  • 142.250.185.68
whitelisted
installer.enigmasoftware.com
  • 169.150.247.39
  • 169.150.247.38
shared
dl.enigmasoftware.com
  • 65.9.95.41
  • 65.9.95.59
  • 65.9.95.78
  • 65.9.95.75
whitelisted
instcfg.enigmasoftware.com
  • 65.9.95.10
  • 65.9.95.129
  • 65.9.95.97
  • 65.9.95.36
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.31.251.109
whitelisted
www.enigmasoftware.com
  • 13.227.219.88
  • 13.227.219.87
  • 13.227.219.23
  • 13.227.219.33
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted

Threats

No threats detected
Process
Message
ShKernel.exe
Main. Enter. Initializing logger...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpyHunter-Installer.exe