| File name: | SecHex-Spoofy V1.5.8 (testing).rar |
| Full analysis: | https://app.any.run/tasks/9074d0ab-fc48-4851-bed1-dde1d3c1868a |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | December 26, 2025, 17:33:27 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 54A4D24576937A3F3E6D3B1244AD831B |
| SHA1: | CEB9E13756D0ABA22C1AB210DBC0FD0731911B45 |
| SHA256: | CCFEA61DE8D32A1DB4525A825A0167525CCCBD3DF5D79986B1E40395E8113FCF |
| SSDEEP: | 98304:QaqcIiW3LhuM16HsMONxu0xIsWyFkbS/Gi+DblbSmmcjUOsGT8Xr9AvhY29oXQxq:du4yZ |
MALICIOUS
GENERIC has been found (auto)
- WinRAR.exe (PID: 7552)
Changes the autorun value in the registry
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
Reads a specific registry key of the VM
- SecHex-GUI.exe (PID: 9164)
SUSPICIOUS
Generic archive extractor
- WinRAR.exe (PID: 7552)
Reads security settings of Internet Explorer
- SecHex-GUI.exe (PID: 7944)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- SecHex-GUI.exe (PID: 9164)
Process drops legitimate windows executable
- WinRAR.exe (PID: 7552)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- msiexec.exe (PID: 8672)
Executable content was dropped or overwritten
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
Starts a Microsoft application from unusual location
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
Starts itself from another location
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
Searches for installed software
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 8672)
The process creates files with name similar to system file names
- msiexec.exe (PID: 8672)
The process drops C-runtime libraries
- msiexec.exe (PID: 8672)
Reads the date of Windows installation
- SecHex-GUI.exe (PID: 9164)
Starts POWERSHELL.EXE for commands execution
- SecHex-GUI.exe (PID: 9164)
Process uses powershell cmdlet to discover network configuration
- SecHex-GUI.exe (PID: 9164)
There is functionality for taking screenshot (YARA)
- SecHex-GUI.exe (PID: 9164)
PowerShell delay command usage (probably sleep evasion)
- powershell.exe (PID: 1136)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7552)
- msedge.exe (PID: 4992)
- msiexec.exe (PID: 8672)
Reads the computer name
- SecHex-GUI.exe (PID: 7944)
- identity_helper.exe (PID: 7664)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- msiexec.exe (PID: 8672)
- msiexec.exe (PID: 8740)
- msiexec.exe (PID: 8884)
- msiexec.exe (PID: 8816)
- SecHex-GUI.exe (PID: 9164)
- msiexec.exe (PID: 8960)
Manual execution by a user
- SecHex-GUI.exe (PID: 7944)
- SecHex-GUI.exe (PID: 7888)
- msedge.exe (PID: 4992)
- SecHex-GUI.exe (PID: 9164)
- SecHex-GUI.exe (PID: 9108)
Checks supported languages
- SecHex-GUI.exe (PID: 7944)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- identity_helper.exe (PID: 7664)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- msiexec.exe (PID: 8672)
- msiexec.exe (PID: 8740)
- msiexec.exe (PID: 8816)
- msiexec.exe (PID: 8884)
- msiexec.exe (PID: 8960)
- SecHex-GUI.exe (PID: 9164)
Application launched itself
- msedge.exe (PID: 8040)
- msedge.exe (PID: 4992)
- msedge.exe (PID: 8068)
Create files in a temporary directory
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
Reads Environment values
- identity_helper.exe (PID: 7664)
The sample compiled with english language support
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- msiexec.exe (PID: 8672)
Process checks computer location settings
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
- SecHex-GUI.exe (PID: 9164)
Reads the machine GUID from the registry
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- msiexec.exe (PID: 8672)
- SecHex-GUI.exe (PID: 9164)
Creates a software uninstall entry
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- msiexec.exe (PID: 8672)
Launching a file from a Registry key
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
Creates files in the program directory
- windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
- SecHex-GUI.exe (PID: 9164)
Reads Windows Product ID
- SecHex-GUI.exe (PID: 9164)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 1136)
Checks proxy server information
- slui.exe (PID: 9048)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 1136)
Confuser has been detected (YARA)
- SecHex-GUI.exe (PID: 9164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| FileVersion: | RAR v5 |
|---|---|
| CompressedSize: | 103469 |
| UncompressedSize: | 1290774 |
| OperatingSystem: | Win32 |
| ArchivedFileName: | SecHex-Spoofy V1.5.8 (testing)/Backup/backup.reg |
Total processes
197
Monitored processes
42
Malicious processes
2
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1136 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Disable-NetAdapter -Name '{07947C7E-CC39-4FA0-BC59-05149EBB5DEA}'; Start-Sleep -Seconds 5; Enable-NetAdapter -Name '{07947C7E-CC39-4FA0-BC59-05149EBB5DEA}'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | SecHex-GUI.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2284 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=6152,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2348 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ffd712af208,0x7ffd712af214,0x7ffd712af220 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2480 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2316,i,3526966866274719478,10829186605118912409,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2844 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3584,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3368 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4208,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4992 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --disable-quic --flag-switches-end --do-not-de-elevate --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16&gui=true | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 5548 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,3526966866274719478,10829186605118912409,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 6296 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5468,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 6636 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7228,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
Total events
26 736
Read events
25 741
Write events
948
Delete events
47
Modification events
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\SecHex-Spoofy V1.5.8 (testing).rar | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
| (PID) Process: | (7552) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | name |
Value: 256 | |||
Executable files
534
Suspicious files
166
Text files
372
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-20-15.txt | text | |
MD5:CEBED1EC6752A1486AA75DE22AAACC67 | SHA256:07658CB35BD12C06635F6594123577C7BCEF90A748482511919829E2383DF84D | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-21-13.txt | text | |
MD5:737FF20AC85D541495E66396276CA309 | SHA256:4685DD8A695A57940B0658C5C2104200F28717057458C552E50F43C857AB2D6D | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-08-20_21-15-01.txt | csv | |
MD5:5E7202C59D67B2F64A6603E18FEEE84E | SHA256:9FF651159C891219CCC58084D02EF18756B86FE28D4D7157667AA43A3BD669BA | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-21-18.txt | text | |
MD5:5864F7984B74676B6FE953BD30D37408 | SHA256:D4E241F512C94CB9998B3232B4EC70476D57BDCBE9F5C2BDBAFCF5157A9BEFA1 | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-09-06_08-33-38.txt | binary | |
MD5:D34163EE17F253E0ADC824D51F1BCA51 | SHA256:438FF383AC9A3ED1D13AEBEA273041DF54D7281701AE2804AC67AEF97953FFAB | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-09-06_08-33-55.txt | text | |
MD5:2F57B6ADFEFBDFB7966284EB93387333 | SHA256:B5CB307EF6E3ED9C634FE3DB734ADDF0AF6792413124868F45C1E049EE1E3B92 | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-09-06_08-33-41.txt | text | |
MD5:5E06CD4F1AD90602125F00ABCAD3FB22 | SHA256:53F5F9896BE32E93980FBDCB1613B960B8165D205DF7CA96008986E0CA720FB0 | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-11-05_22-45-33.txt | binary | |
MD5:F337B697A65D17E8249714D28D31688A | SHA256:D3B5F9584F0679867BCCA304B4B8E6D4256063C08734F0D3B6256E937ECAEDAF | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-09-06_08-34-56.txt | text | |
MD5:C9D670B99DA1DD5B8F48B3728DD8FB76 | SHA256:446F2077CFA914D911D02AB6679286BE912A3341071CF66812A1B5588F718034 | |||
| 7552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-09-06_08-33-45.txt | text | |
MD5:2B04A347482E503B5A60550415A8EFAB | SHA256:77D0C95CA9492DE64C98629F90339848E48447B75EF7D635F198FF5CAC6F5591 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
83
DNS requests
76
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7352 | msedge.exe | GET | 301 | 23.59.18.10:443 | https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16&gui=true | US | — | — | unknown |
7352 | msedge.exe | GET | 302 | 13.107.246.44:443 | https://dotnet.microsoft.com/get-dotnet/dotnet-core?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16&gui=true | US | — | — | whitelisted |
7352 | msedge.exe | GET | 302 | 13.107.246.44:443 | https://dotnet.microsoft.com/download/dotnet/6.0/runtime?cid=getdotnetcore&runtime=desktop&os=windows&arch=x64 | US | — | — | whitelisted |
7352 | msedge.exe | GET | 302 | 13.107.246.44:443 | https://dotnet.microsoft.com/download/dotnet/thank-you/runtime-desktop-6.0.36-windows-x64-installer?cid=getdotnetcore | US | — | — | whitelisted |
5148 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | NL | binary | 825 b | whitelisted |
5148 | svchost.exe | GET | 200 | 23.52.181.212:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
7352 | msedge.exe | GET | 200 | 150.171.22.17:443 | https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=66&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1741678270&lafgdate=0 | US | text | 768 b | whitelisted |
7352 | msedge.exe | GET | 200 | 150.171.28.11:443 | https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 | US | text | 462 b | whitelisted |
7352 | msedge.exe | GET | 200 | 104.18.23.222:443 | https://copilot.microsoft.com/c/api/user/eligibility | US | text | 25 b | whitelisted |
7352 | msedge.exe | GET | 200 | 150.171.28.11:80 | http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:kaZ6gQtJTx3XDIQXuypHkFC5d7s1FsO2ghgrdh4iJBo&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | US | text | 100 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5148 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
6768 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1156 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
5148 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5148 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | AKAMAI-ASN1 | NL | whitelisted |
5148 | svchost.exe | 23.52.181.212:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
5148 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7352 | msedge.exe | 150.171.28.11:80 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
aka.ms |
| whitelisted |
copilot.microsoft.com |
| whitelisted |
dotnet.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
Process | Message |
|---|---|
SecHex-GUI.exe | You must install .NET to run this application.
App: C:\Users\admin\Desktop\SecHex-Spoofy V1.5.8 (testing)\SecHex-GUI.exe
Architecture: x64
App host version: 6.0.16
.NET location: Not found
Learn about runtime installation:
https://aka.ms/dotnet/app-launch-failed
Download the .NET runtime:
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16 |
SecHex-GUI.exe | Profiler was prevented from loading notification profiler due to app settings.
Process ID (decimal): 9164. Message ID: [0x2509].
|