File name:

SecHex-Spoofy V1.5.8 (testing).rar

Full analysis: https://app.any.run/tasks/9074d0ab-fc48-4851-bed1-dde1d3c1868a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 26, 2025, 17:33:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-doc
auto
generic
loader
confuser
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

54A4D24576937A3F3E6D3B1244AD831B

SHA1:

CEB9E13756D0ABA22C1AB210DBC0FD0731911B45

SHA256:

CCFEA61DE8D32A1DB4525A825A0167525CCCBD3DF5D79986B1E40395E8113FCF

SSDEEP:

98304:QaqcIiW3LhuM16HsMONxu0xIsWyFkbS/Gi+DblbSmmcjUOsGT8Xr9AvhY29oXQxq:du4yZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 7552)

    • Changes the autorun value in the registry

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)

    • Reads a specific registry key of the VM

      • SecHex-GUI.exe (PID: 9164)

  • SUSPICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7552)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7552)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • msiexec.exe (PID: 8672)

    • Reads security settings of Internet Explorer

      • SecHex-GUI.exe (PID: 7944)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • SecHex-GUI.exe (PID: 9164)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)

    • Executable content was dropped or overwritten

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)

    • Searches for installed software

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)

    • Starts itself from another location

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 8672)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 8672)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 8672)

    • Reads the date of Windows installation

      • SecHex-GUI.exe (PID: 9164)

    • Starts POWERSHELL.EXE for commands execution

      • SecHex-GUI.exe (PID: 9164)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 1136)

    • Process uses powershell cmdlet to discover network configuration

      • SecHex-GUI.exe (PID: 9164)

    • There is functionality for taking screenshot (YARA)

      • SecHex-GUI.exe (PID: 9164)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7552)
      • msedge.exe (PID: 4992)
      • msiexec.exe (PID: 8672)

    • Manual execution by a user

      • SecHex-GUI.exe (PID: 7944)
      • SecHex-GUI.exe (PID: 7888)
      • msedge.exe (PID: 4992)
      • SecHex-GUI.exe (PID: 9108)
      • SecHex-GUI.exe (PID: 9164)

    • Checks supported languages

      • SecHex-GUI.exe (PID: 7944)
      • identity_helper.exe (PID: 7664)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • msiexec.exe (PID: 8672)
      • msiexec.exe (PID: 8740)
      • msiexec.exe (PID: 8816)
      • SecHex-GUI.exe (PID: 9164)
      • msiexec.exe (PID: 8884)
      • msiexec.exe (PID: 8960)

    • Reads the computer name

      • SecHex-GUI.exe (PID: 7944)
      • identity_helper.exe (PID: 7664)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • msiexec.exe (PID: 8672)
      • msiexec.exe (PID: 8740)
      • msiexec.exe (PID: 8816)
      • msiexec.exe (PID: 8884)
      • msiexec.exe (PID: 8960)
      • SecHex-GUI.exe (PID: 9164)

    • Application launched itself

      • msedge.exe (PID: 8040)
      • msedge.exe (PID: 8068)
      • msedge.exe (PID: 4992)

    • Reads Environment values

      • identity_helper.exe (PID: 7664)

    • Create files in a temporary directory

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)

    • The sample compiled with english language support

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8288)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • msiexec.exe (PID: 8672)

    • Process checks computer location settings

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8312)
      • SecHex-GUI.exe (PID: 9164)

    • Creates a software uninstall entry

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • msiexec.exe (PID: 8672)

    • Creates files in the program directory

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • SecHex-GUI.exe (PID: 9164)

    • Launching a file from a Registry key

      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 8672)
      • windowsdesktop-runtime-6.0.36-win-x64.exe (PID: 8588)
      • SecHex-GUI.exe (PID: 9164)

    • Reads Windows Product ID

      • SecHex-GUI.exe (PID: 9164)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1136)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1136)

    • Confuser has been detected (YARA)

      • SecHex-GUI.exe (PID: 9164)

    • Checks proxy server information

      • slui.exe (PID: 9048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 103469
UncompressedSize: 1290774
OperatingSystem: Win32
ArchivedFileName: SecHex-Spoofy V1.5.8 (testing)/Backup/backup.reg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
42
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe sechex-gui.exe no specs sechex-gui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs windowsdesktop-runtime-6.0.36-win-x64.exe windowsdesktop-runtime-6.0.36-win-x64.exe windowsdesktop-runtime-6.0.36-win-x64.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs slui.exe sechex-gui.exe no specs sechex-gui.exe powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Disable-NetAdapter -Name '{07947C7E-CC39-4FA0-BC59-05149EBB5DEA}'; Start-Sleep -Seconds 5; Enable-NetAdapter -Name '{07947C7E-CC39-4FA0-BC59-05149EBB5DEA}'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—SecHex-GUI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2284"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=6152,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ffd712af208,0x7ffd712af214,0x7ffd712af220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2480"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2316,i,3526966866274719478,10829186605118912409,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2844"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3584,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3368"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4208,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4992"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --disable-quic --flag-switches-end --do-not-de-elevate --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16&gui=trueC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5548"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,3526966866274719478,10829186605118912409,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6296"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5468,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6636"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7228,i,14389996823896780780,17574321246883760706,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
26 736
Read events
25 741
Write events
948
Delete events
47

Modification events

(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SecHex-Spoofy V1.5.8 (testing).rar
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(7552) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
534
Suspicious files
166
Text files
372
Unknown types
1

Dropped files

PID
Process
Filename
Type
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-20-15.txttext
MD5:CEBED1EC6752A1486AA75DE22AAACC67
SHA256:07658CB35BD12C06635F6594123577C7BCEF90A748482511919829E2383DF84D
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-08-20_21-15-01.txtcsv
MD5:5E7202C59D67B2F64A6603E18FEEE84E
SHA256:9FF651159C891219CCC58084D02EF18756B86FE28D4D7157667AA43A3BD669BA
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-21-29.txtcsv
MD5:59EB4D60CA69CFC4D9D46D08DBAA9A87
SHA256:E8B65EF8D72464EFFAE5737E799373B166F57F5CC8B60903A9510091488F2D0B
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-21-08.txttext
MD5:D361C40DEFF519F6239926055759125D
SHA256:AE883B380B7F901F700145EE09BB2E947BE8975D83AC496A354832BB2029CC7E
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Backup\backup.regtext
MD5:AE90258E510641DFD6BB74E5A67B9169
SHA256:EFC4FF0C45E0638A54E9CA342F60E7977075198616065D47FA4A177821511E20
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-09-04_20-42-38.txtbinary
MD5:69CC7A4FC97044D0A1258BF1ECC6A9A6
SHA256:E6758DC125D750993163A7BDFD4DCF65D74C76FD035203EC1FC1B3D0261F9277
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-09-06_08-33-38.txtbinary
MD5:D34163EE17F253E0ADC824D51F1BCA51
SHA256:438FF383AC9A3ED1D13AEBEA273041DF54D7281701AE2804AC67AEF97953FFAB
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-21-18.txttext
MD5:5864F7984B74676B6FE953BD30D37408
SHA256:D4E241F512C94CB9998B3232B4EC70476D57BDCBE9F5C2BDBAFCF5157A9BEFA1
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2025-11-08_15-42-01.txtbinary
MD5:3F5E93387D7C1A859A6F05DBF282DE4E
SHA256:1770D60EA5600A0B4DF648D7FDDDD1EDDB553331A96B16BB503070D412031864
7552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7552.5483\SecHex-Spoofy V1.5.8 (testing)\Logs\2024-07-28_13-21-13.txttext
MD5:737FF20AC85D541495E66396276CA309
SHA256:4685DD8A695A57940B0658C5C2104200F28717057458C552E50F43C857AB2D6D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
83
DNS requests
76
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7352
msedge.exe
GET
301
23.59.18.10:443
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16&gui=true
US
—
—
unknown
7352
msedge.exe
GET
302
13.107.246.44:443
https://dotnet.microsoft.com/get-dotnet/dotnet-core?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16&gui=true
US
—
—
whitelisted
7352
msedge.exe
GET
302
13.107.246.44:443
https://dotnet.microsoft.com/download/dotnet/6.0/runtime?cid=getdotnetcore&runtime=desktop&os=windows&arch=x64
US
—
—
whitelisted
7352
msedge.exe
GET
302
13.107.246.44:443
https://dotnet.microsoft.com/download/dotnet/thank-you/runtime-desktop-6.0.36-windows-x64-installer?cid=getdotnetcore
US
—
—
whitelisted
5148
svchost.exe
GET
200
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=562&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
5.48 Kb
whitelisted
5148
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5148
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5148
svchost.exe
GET
200
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=562&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
1.43 Kb
whitelisted
7352
msedge.exe
GET
200
150.171.28.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
US
text
462 b
whitelisted
7352
msedge.exe
GET
200
104.18.23.222:443
https://copilot.microsoft.com/c/api/user/eligibility
US
text
25 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5148
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1156
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5148
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5148
svchost.exe
23.48.23.156:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5148
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5148
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7352
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.251.140.174
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
aka.ms
  • 23.59.18.10
whitelisted
copilot.microsoft.com
  • 104.18.23.222
  • 104.18.22.222
whitelisted
dotnet.microsoft.com
  • 13.107.246.44
whitelisted
www.bing.com
  • 92.123.104.63
  • 92.123.104.12
  • 92.123.104.11
  • 92.123.104.64
  • 92.123.104.8
  • 92.123.104.67
  • 92.123.104.6
  • 92.123.104.66
  • 92.123.104.9
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
SecHex-GUI.exe
You must install .NET to run this application. App: C:\Users\admin\Desktop\SecHex-Spoofy V1.5.8 (testing)\SecHex-GUI.exe Architecture: x64 App host version: 6.0.16 .NET location: Not found Learn about runtime installation: https://aka.ms/dotnet/app-launch-failed Download the .NET runtime: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.16
SecHex-GUI.exe
Profiler was prevented from loading notification profiler due to app settings. Process ID (decimal): 9164. Message ID: [0x2509].
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecHex-Spoofy V1.5.8 (testing).rar