File name:

SpyHunter-5.17-6-5285-Installer.exe

Full analysis: https://app.any.run/tasks/6db8ed4c-d272-4247-b30b-d87edf42dd51
Verdict: Malicious activity
Analysis date: November 15, 2024, 17:55:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

E7F0449AEC26F5BA3B1AA0ADC8239838

SHA1:

B7B0DD2539C25973AA4C731BB11F12DB59010DF7

SHA256:

9AD8D984E52B05675A4C4C3452FFCEC38C7DC4C9E33D572CE06B61BB83B3942C

SSDEEP:

98304:cs0XdIAadhUSoYxNSF4NljaX090Z1xQhTbm36SlBczcJfkTbqj6wCenlXu6da9cq:WYKR9/wFN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • SpyHunter-5.17-6-5285-Installer.exe (PID: 3644)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • SpyHunter-5.17-6-5285-Installer.exe (PID: 3644)

    • Executable content was dropped or overwritten

      • SpyHunter-5.17-6-5285-Installer.exe (PID: 3644)
      • ShKernel.exe (PID: 7388)

    • Starts SC.EXE for service management

      • SpyHunter-5.17-6-5285-Installer.exe (PID: 3644)

    • Executes as Windows Service

      • ShKernel.exe (PID: 7388)
      • ShMonitor.exe (PID: 7856)

    • Drops a system driver (possible attempt to evade defenses)

      • ShKernel.exe (PID: 7388)

  • INFO

    • Reads the computer name

      • SpyHunter-5.17-6-5285-Installer.exe (PID: 3644)

    • Checks supported languages

      • SpyHunter-5.17-6-5285-Installer.exe (PID: 3644)

    • Application launched itself

      • msedge.exe (PID: 3740)
      • msedge.exe (PID: 7112)

    • Manual execution by a user

      • msedge.exe (PID: 7112)

    • Sends debugging messages

      • ShKernel.exe (PID: 7388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:08 08:55:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4880896
InitializedDataSize: 2381824
UninitializedDataSize: -
EntryPoint: 0x2adc87
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.0.891.5380
ProductVersionNumber: 3.0.891.5380
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: EnigmaSoft Limited
FileDescription: EnigmaSoft Installer
FileVersion: 3.0.891.5380
InternalName: Installer.exe
LegalCopyright: Copyright 2016-2024. EnigmaSoft Limited. All rights reserved.
OriginalFileName: Installer.exe
ProductName: Installer
ProductVersion: 3.0.891.5380
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
189
Monitored processes
58
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start spyhunter-5.17-6-5285-installer.exe sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs msedge.exe no specs sc.exe no specs conhost.exe no specs msedge.exe no specs sc.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs regsvr32.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sc.exe no specs conhost.exe no specs shkernel.exe sc.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs shmonitor.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs spyhunter5.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs spyhunter-5.17-6-5285-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
512"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2252 --field-trial-handle=2292,i,3059765920714439629,8368393227390062003,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1156"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5360 --field-trial-handle=2420,i,18156139567118243168,4375113898532857518,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1344"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4644 --field-trial-handle=2420,i,18156139567118243168,4375113898532857518,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1584"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3460 --field-trial-handle=2420,i,18156139567118243168,4375113898532857518,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1744C:\WINDOWS\System32\sc.exe create EsgShKernel start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe\"" DisplayName= "SpyHunter 5 Kernel"C:\Windows\System32\sc.exe—SpyHunter-5.17-6-5285-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1768"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3204 --field-trial-handle=2420,i,18156139567118243168,4375113898532857518,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2000"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4128 --field-trial-handle=2420,i,18156139567118243168,4375113898532857518,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2620"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6792 --field-trial-handle=2420,i,18156139567118243168,4375113898532857518,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2816C:\WINDOWS\System32\sc.exe description ShMonitor "SpyHunter 5 Kernel Monitor"C:\Windows\System32\sc.exe—SpyHunter-5.17-6-5285-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
102 649
Read events
102 580
Write events
65
Delete events
4

Modification events

(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:LanguageType
Value:
EN
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:ITime
Value:
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:GuardEnabled
Value:
1
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:GuardUnknownExecution
Value:
1
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:GuardUnknownPromptOnlySuspicious
Value:
1
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:CloudAnalysis
Value:
1
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:ShowArmW10Warning
Value:
1
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:ICfg
Value:
e72d8cb294cee996ff651da25d101b5aad690c18f315b567a154a745ce4cde89b4b75113893fda6cdde508dc9c7de3002ac8d02a84ce50a341176b2bad9d90ef
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:AdFlags
Value:
1
(PID) Process:(3644) SpyHunter-5.17-6-5285-Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EnigmaSoft\SpyHunter\SpyHunterConfig
Operation:writeName:Language
Value:
English.lng
Executable files
13
Suspicious files
307
Text files
51
Unknown types
5

Dropped files

PID
Process
Filename
Type
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exeexecutable
MD5:AE492B8C9E2F27FF54719C6A64985241
SHA256:03FC09348BD3155A8B94AF544A1A11672C3B69F5939C9C740F7901B7BC23856D
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\WebSecurityNative.exeexecutable
MD5:74E7ACF0A90AB3364EF9B8437B09B749
SHA256:9EEF47DD19664D065DB3F4F56BF745022DD11A13DA77BFE9B0AA834F2EED55E1
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\purl.datbinary
MD5:B4EDDF5E35BC5F6913A246530705A151
SHA256:AE2DDA813C46DC3FA74D1B5E671E1D0A77BE156899B21E69A185BA5B6BECC0E4
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exeexecutable
MD5:CECF9DB6546796B3E684D321BFAC9093
SHA256:16BFA77BBFBBBF92F0EEE3D284A9A8620DD5F7D81B818F53BFB6651F2644D53D
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\7z.dllexecutable
MD5:A348DC27A6B88E8CFE3D62500F3FB97C
SHA256:50D399B68B03BCB0C3BE6B89B077DE9DC3567E1399CDE955A04A7177A5944059
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Danish.lngbinary
MD5:6117C06FAEDA8A325EF411F14A13FEEE
SHA256:B1C291F9085D604D8F0F25DAF743A2D634169D99A346B575D1A5A5D3667288B5
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lngbinary
MD5:75A8F05C4ED8F33CE54B648A8E6B9318
SHA256:8E456999D49BE159E1B9E392C7DFAF1F9D71D6EAE5AB90A8AC6D444C76FAB917
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exeexecutable
MD5:99706A68F10E1940678B6F406B918AC8
SHA256:5568A89EE163C1BD5DDC712F8AD27658D8EBC27A1169738D2983BD1D35C6823A
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lngbinary
MD5:7589BECC936D53461AF5EEDC35EE4DB2
SHA256:7082E64E09E1CE09F402788D8688BE9B9440388E9A6E3DBB2BCFD27879D0B3C0
3644SpyHunter-5.17-6-5285-Installer.exeC:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lngbinary
MD5:E5861434893F8D93150C07D7ABBC6821
SHA256:BC7BBC5CC4B253DF36BA9F5B9190AB03B053F977B18210395B2B52EAF2929842
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
224
DNS requests
178
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3644
SpyHunter-5.17-6-5285-Installer.exe
GET
301
169.150.247.36:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_vmlinuz.ecf
unknown
—
—
whitelisted
3644
SpyHunter-5.17-6-5285-Installer.exe
GET
301
169.150.247.36:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.mbr.ecf
unknown
—
—
whitelisted
3644
SpyHunter-5.17-6-5285-Installer.exe
GET
301
169.150.247.36:80
http://installer.enigmasoftware.com/shos5/3.18.5/sh5_shldr.ecf
unknown
—
—
whitelisted
7388
ShKernel.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
7388
ShKernel.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
7388
ShKernel.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
7388
ShKernel.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
7388
ShKernel.exe
GET
200
23.53.41.90:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.53.41.96:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1588
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
23.53.41.96:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3644
SpyHunter-5.17-6-5285-Installer.exe
13.224.189.76:443
geo-ip.enigmasoft.net
AMAZON-02
US
suspicious
3644
SpyHunter-5.17-6-5285-Installer.exe
169.150.247.38:80
installer.enigmasoftware.com
—
GB
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.41.96
  • 23.53.41.90
  • 23.53.40.170
  • 23.53.40.192
  • 23.53.40.169
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 142.250.186.110
whitelisted
geo-ip.enigmasoft.net
  • 13.224.189.76
  • 13.224.189.41
  • 13.224.189.33
  • 13.224.189.67
unknown
installer.enigmasoftware.com
  • 169.150.247.38
  • 169.150.247.36
shared
www.google-analytics.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.162
  • 104.126.37.168
  • 104.126.37.161
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.163
  • 2.23.209.140
  • 2.23.209.179
  • 2.23.209.149
  • 2.23.209.177
  • 2.23.209.150
  • 2.23.209.148
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.176
  • 2.23.209.144
  • 2.23.209.185
  • 2.23.209.135
  • 2.23.209.141
  • 2.23.209.189
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.72
whitelisted

Threats

No threats detected
Process
Message
ShKernel.exe
Main. Enter. Initializing logger...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpyHunter-5.17-6-5285-Installer.exe