hxxps://dosya[.]co/b70651x1j1gg/SecHex_Spoofer[.]rar[.]html

Analysis

user interaction
yes
max time kernel
12s
max time network
87s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/07/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/b70651x1j1gg/SecHex_Spoofer.rar.html
Sample260715-nsa67abs7j

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285891580947385"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{9A4B7D94-C089-40C7-B010-D8C20A265AE4}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2000	4068	msedge.exe	83
PID 4068 wrote to memory of 8	4068	msedge.exe	85
PID 4068 wrote to memory of 2068	4068	msedge.exe	86
PID 4068 wrote to memory of 8	4068	msedge.exe	85
PID 4068 wrote to memory of 8	4068	msedge.exe	85
PID 4068 wrote to memory of 4092	4068	msedge.exe	87
PID 4068 wrote to memory of 4092	4068	msedge.exe	87
PID 4068 wrote to memory of 3528	4068	msedge.exe	88
PID 4068 wrote to memory of 3528	4068	msedge.exe	88
PID 4068 wrote to memory of 568	4068	msedge.exe	89
PID 4068 wrote to memory of 3528	4068	msedge.exe	88
PID 4068 wrote to memory of 568	4068	msedge.exe	89
PID 4068 wrote to memory of 568	4068	msedge.exe	89
PID 4068 wrote to memory of 996	4068	msedge.exe	90
PID 4068 wrote to memory of 4748	4068	msedge.exe	91
PID 4068 wrote to memory of 996	4068	msedge.exe	90
PID 4068 wrote to memory of 996	4068	msedge.exe	90
PID 4068 wrote to memory of 4748	4068	msedge.exe	91
PID 4068 wrote to memory of 4748	4068	msedge.exe	91
PID 4068 wrote to memory of 2884	4068	msedge.exe	95
PID 4068 wrote to memory of 2884	4068	msedge.exe	95
PID 4068 wrote to memory of 1100	4068	msedge.exe	96
PID 4068 wrote to memory of 1100	4068	msedge.exe	96
PID 4068 wrote to memory of 4880	4068	msedge.exe	98
PID 4068 wrote to memory of 3436	4068	msedge.exe	99
PID 4068 wrote to memory of 3436	4068	msedge.exe	99
PID 4068 wrote to memory of 3436	4068	msedge.exe	99
PID 4068 wrote to memory of 4760	4068	msedge.exe	100
PID 4068 wrote to memory of 4760	4068	msedge.exe	100
PID 4068 wrote to memory of 4760	4068	msedge.exe	100
PID 4068 wrote to memory of 4820	4068	msedge.exe	101
PID 4068 wrote to memory of 4820	4068	msedge.exe	101
PID 4068 wrote to memory of 4820	4068	msedge.exe	101
PID 4068 wrote to memory of 2200	4068	msedge.exe	102
PID 4068 wrote to memory of 2200	4068	msedge.exe	102
PID 4068 wrote to memory of 2200	4068	msedge.exe	102
PID 4068 wrote to memory of 2732	4068	msedge.exe	105
PID 4068 wrote to memory of 1360	4068	msedge.exe	106
PID 4068 wrote to memory of 2732	4068	msedge.exe	105
PID 4068 wrote to memory of 1360	4068	msedge.exe	106
PID 4068 wrote to memory of 1360	4068	msedge.exe	106
PID 4068 wrote to memory of 680	4068	msedge.exe	107
PID 4068 wrote to memory of 2000	4068	msedge.exe	83
PID 4068 wrote to memory of 8	4068	msedge.exe	85
PID 4068 wrote to memory of 2068	4068	msedge.exe	86
PID 4068 wrote to memory of 8	4068	msedge.exe	85
PID 4068 wrote to memory of 8	4068	msedge.exe	85
PID 4068 wrote to memory of 4092	4068	msedge.exe	87
PID 4068 wrote to memory of 4092	4068	msedge.exe	87
PID 4068 wrote to memory of 3528	4068	msedge.exe	88
PID 4068 wrote to memory of 3528	4068	msedge.exe	88
PID 4068 wrote to memory of 568	4068	msedge.exe	89
PID 4068 wrote to memory of 3528	4068	msedge.exe	88
PID 4068 wrote to memory of 568	4068	msedge.exe	89
PID 4068 wrote to memory of 568	4068	msedge.exe	89
PID 4068 wrote to memory of 996	4068	msedge.exe	90
PID 4068 wrote to memory of 4748	4068	msedge.exe	91
PID 4068 wrote to memory of 996	4068	msedge.exe	90
PID 4068 wrote to memory of 996	4068	msedge.exe	90
PID 4068 wrote to memory of 4748	4068	msedge.exe	91
PID 4068 wrote to memory of 4748	4068	msedge.exe	91
PID 4068 wrote to memory of 2884	4068	msedge.exe	95
PID 4068 wrote to memory of 2884	4068	msedge.exe	95
PID 4068 wrote to memory of 1100	4068	msedge.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/b70651x1j1gg/SecHex_Spoofer.rar.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fff9193c188,0x7fff9193c194,0x7fff9193c1a0
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,9750478797103282007,1953899515658296734,262144 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,3949205301879832693,14520996522242816774,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,7323481189171317942,4664943089335416871,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,15505449137184334407,11032526471851939373,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10242529883112877131,5818607811763226123,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,4512841922458830183,17188163162578314462,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,13113477801663800074,15425203819538929153,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,4904128961750225540,6263217718626173868,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,12965626143527525909,3794591847982956777,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14001823132519529207,135916544722246080,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14001823132519529207,135916544722246080,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6168,i,9293532869287392009,6244613474972627432,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4772,i,11716776148195650856,2259681724110153876,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6464,i,6958698055996070479,16689947781400054705,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6780,i,17322909640247292732,1902252547695126991,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,15796151870446511454,16382965610777015949,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7408,i,10547417516207043180,18226034659833074071,2097152 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,5221413626036696189,1039092308281832231,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,12132770557112079334,8055216145403752181,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=808 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,5032771942373458214,14525701157445280738,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,3584236463702283295,16668327189590071113,524288 --field-trial-handle=2832,i,3100916690746412962,14936322056623531516,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SecHex Spoofer\" -spe -an -ai#7zMap11489:90:7zEvent1030
1⤵
PID:560

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SecHex Spoofer\" -spe -an -ai#7zMap8774:90:7zEvent24790
1⤵
PID:5832

C:\Users\Admin\Downloads\SecHex Spoofer\SecHex-GUI.exe
"C:\Users\Admin\Downloads\SecHex Spoofer\SecHex-GUI.exe"
1⤵
PID:3324
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface set interface "Ethernet" disable
  2⤵
  PID:3908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 35d749c6179e163f07e484857b3a8ee4414c2073264bd5cb68098006605c7b3c
MD5 1c6f702f0693fdea1878e94d689a7755
SHA1 4524c38f457c9add40a9fae30fc9208465204349
SHA512 19f108ca7bf85c4ee2f75eb739dccb6fd6a5dd33ea84a889a6b6c496bfb247eb041dfd4c76d30f68fd2ab30ec3fab7202ff163223f3ecbb0f9f8efbc9b48da35
SSDEEP 48:CdXWy4Hu2DHDLqK1W8m9fyBb6rH8WrkoZuFb9lXkmv5nOY/QCjl/Pkthefwc4x:CdXlMVe5G2rA5BvNOYoCyPev4x
TLSH
T1BA91F0BE51A522B1EBD0903DF1C02909757688FE7ECB3F7A61B8173ED41D78918825CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e087.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e087.TMP
Size 3KB
SHA256 e6be29ab1a89b8b9289497e7e32284d5d390c4e2e52643c9ec5e77fda7329ef5
MD5 398460c91054449f977b927431b117a6
SHA1 03fe1333ad80fd49685a78ea01d23eca7f3719b8
SHA512 6cee730ee5a88253ea6066747c0cf5233e6b94a4771dd690763acd3c24ff39acce468858c8356f9240dc78b038660b705aae0d9d8903d5629f7986fe6e9be823
TLSH
T14871B5B6117257B1E390907EE0D02619763698FEBFCB3FAE2178573CA10C75529838CA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c93da2d1576c1c8836fc6ac44e3dc626d3c75052afe0a02ff9d50dc10fdc958a
MD5 68f2104c181617828f0e3cb32b12e6fd
SHA1 ff6b44e6c57b66c384751d6b8125be7d482841bf
SHA512 fd7fa60469552e4c1801be8c7f8b257d7cf82a744595cd4df2505b0c04a8773f871d5114066d8c4dd4bd74ec31a3e944dfb218535f936f21666515e252a5d8d6
SSDEEP 192:sxZYRDyM/jK1Ml8M9a/fHsdJWQIdpRlVHW6+WNIQH/Yr3ZNshVIg507J:sxZYV1a/fHsdJMhHbb/E8zON
TLSH
T19A52C812AA34597BCCCBD209B9457B93D6F55573E3901E44AAFC8A0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f7b6e203dd28c4a95f3030c04352be75970cd5cf19bc156c1598113e795cd6fb
MD5 4840f5170dc6053acd6179f2baf1543f
SHA1 2c350665c0a1a4ac3f8446ba2bfcb7f8e5534aad
SHA512 0b00a139f3b3d72a492c7484fff19f1986802014f0655072e4809d9e70788e5afe727192faa0d72d2b146fba1881ecc26570e69de570df0625505e55d5a4beef
SSDEEP 192:sxZYRDyM/jK1Ml8Mka/fHsjJWQIdpRlVHW6+WNIQH/Yr3ZishVIgU7J:sxZYVMa/fHsjJMhHbb/EZzUN
TLSH
T1DC42D8126A34597BCCCBD209BA45BF93D6F55573E3901E44AAFC8A0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b8b068cd0d69dcb9f62e3f034bcbc584f19937670438ea7e1e73ebfb2a2bee93
MD5 ff8f60717d6e17edee68c5ec0af03965
SHA1 f9b027d113d50a73280c43eaeb57cf9ac3a9f6e5
SHA512 741dce83231e7db8aaf69f060ef04dbf4b16820e35fbf9ec24c952605369794506db8ff157cccd6b623d36dba0f9981717f8d199ee021a005b2aab7cc1acf2b8
SSDEEP 768:e3gL6XeWviSnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRtroWZXT0G7:e3gL6XeWviSnqu1jaSJL7+RGWeG7
TLSH
T194E20A3B690CCB7E4F840E5CED26AF876ED801CB5B984D8447FA494C03C77EA512A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6a2d494cb4b4ada64e44a8e050d2512a402dbc5a29362f4c06911b3a9ad52be2
MD5 dff11e25d751dabbc9deb3824f443f37
SHA1 6d1b5e19f2d93d4d85314759aebf4dcfe3ede452
SHA512 0008dd4f5a1696c0474391ed53db11246de3cea7c86a821e484e88d3fc6878dfced02d01a5294b379e4335934efe7e9e34f6b80ac11a82e81f7725a3b014301e
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ5cxIlK6go3y1fIRKQQUQQ:KwX+KUsCxGK6gSOfmKQQbQ
TLSH
T19B915D02753B864238BD181C92E695379E8335A33528A5AF7FB470A20E7BD510EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 54d0efce93c9fa08a34b49600828b98c1619315423827ab3d16d052707268c6f
MD5 6d1e7fca5837a2be99dfa38abbb4a288
SHA1 1c5e454f740d3fc21bfdfe52d47ecd1841d4283f
SHA512 f59bc5dcc673dc33f5084b6350f4098862b33cc5483b1e443c7ec1ab6d3699cfe763c6c94724b6673e918c31aab971cf697cc24eba153e6d695b04ffaa0cde11
SSDEEP 384:5tNn/s3n9SfsNJkXy0ng8pQx9uO8iYa9ScjmwG/:5j+9U+HnfYa91jy/
TLSH
T1BB928D376D245CA76FE2A581F84B361B9FB8517396C03F94DAEC3F0C05DA29C1316A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc455ca43df0dd6c8efa8e0c818f6db6d31735433ffee4bad5cd68eb90356336
MD5 351ff3adae358f8b4037f1284472c808
SHA1 43cf6bf7a658c0f8fc39296f7252599dea9a41ba
SHA512 527162c8ae08dff478e77f4617745ca08a1048e66145adb75de70581682703923d8ac47da1acddad5606f4b14165a856d22248f3ce9c1abce756670d2b2742b7
SSDEEP 96:RqONkTQsjpfVC10tOJ5ih/cIPURHl8h4otop5tRDEBOPPvfzSuOaPzMvWfGqsb+F:YONn6LCWtDQmiUy/oILSuOCzTRsEZBU6
TLSH
T14502D73AA9686C779EF37E45B4873B275FA41037E9903F54DAD82B1C01DB64C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 04bc43320cd497a734b86159ab9a407099e3778c0b28eaad656583c35f34fceb
MD5 71cc7c34c3b090e9aef1579da27068de
SHA1 bb037aff0937c12eee3a1dae024fd0591bb2e3ef
SHA512 403a8589988483606b3ce939f0365b5cddab59304028b0eb86c20b8b591b2b4e25a6c7a0cd559745ab43b9beb5e41bd6bccd8676c2e13f93b113de570ac8faea
SSDEEP 384:0tNn/s3n9SgsNJAXy0ng8ZQx9uO8iYa9ScjmwG/:0j+9vOHnfYa91jy/
TLSH
T1E9928D37AD245C676EE2A585F84B361B9F78516396C03F94DAEC3F0D01CB2DC1316A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9d2c6bf84f573c60dbdf6e964c5b07b6cbc197f0646d8ebc366fe5246430c81c
MD5 6591845142496a4f1ee6eb3309124228
SHA1 d0d25d76e0fd93f752fe2eee49cdf72ca0187e8b
SHA512 de550d4dec35f26b65be0df2ead2ebf77813b907585eddbd5c164b30e445c6e628dac2be486a2f2d323bfb0fa17ca538b794635a8e0113f25e8b94a337dbf211
SSDEEP 384:ktNn/s3n9SgsNJA2y0ng8ZQx9uO8iYa9ScjmwG/:kj+9vhHnfYa91jy/
TLSH
T1F7928D376D245C676ED2A585F84B361B9F78516396C03F94DAEC3F0D01CB29C1316A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92aa0c0a4e0d2ab9a1cf4a0b460a4b0d524d42e2b7ed27d428e6c4466925c8e1
MD5 d8d1785bc583f459dcdc0d0ddefbe1ef
SHA1 67f5bc73653ecfa428c6f1c8f3fb1fdc65a96566
SHA512 b2a701e0cdedf241fc828797452f3716032b974b257fc9b8255de043f79240c26d994b3bcec0a5fe1031c0e528677b8b2025632e9845833bb3b129e186a682d8
SSDEEP 192:7ON86LCWtIQmiUyXoDLSuOCzTGYDGGkI/OqBU6:7ON86mgoHDmuO8iYx9U6
TLSH
T14F12093768685C775EE2B981B48736175FB45123EA843F94DADC3F1C06EF28C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ce133ee-3b1f-4fcd-8b2f-2aaf53e67ae5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1ce133ee-3b1f-4fcd-8b2f-2aaf53e67ae5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f09a9aaff7af8d6cf515e45e2399c5306d56dad4453f874f856134bb8ea65a57
MD5 e7d1db8018d66fbe326201f36b0fe82b
SHA1 c97914cbed03f4e5e0de2f851f5365d8b1638c6f
SHA512 6288551f84cb944e910b4c9c0fafb680cb175bea747ef2efe087b56209ee797dc6b0e476d5b5a671d2b7a8548c8053bb8a8c8ac5b55fcc774dbd2670b2f211b0
TLSH
T13941D658A6F91108B3B76F16AFF6B86E447EBD632E06C49D00110E4F0A22B00C972737
MD5 SHA1 SHA512 TLSH

Submit Download

SecHex Spoofer.rar.crdownload

Path C:\Users\Admin\Downloads\SecHex Spoofer.rar.crdownload
Size 1.9MB
SHA256 65ba07423f80e9bd3144939db28757e3be7c0a8d3c2ba9504f531622328bf501
MD5 1b617f856e9858f5a96f4f3e64b110ba
SHA1 e8163921af6011e64e769b9a227ba49d4fd5bddd
SHA512 4dba015bba0c39e91ccf7ebc07e0458f04408222edb5ee2de722f360ff406ed3cb489089c89086824aa4ce8d3680a130203bd07f42dd641412c7fe3136b55612
SSDEEP 49152:zmAcVnyTPU3v4guprkBilZ+w9Ri6XgntVQvWluJn:z5ccbU3gBXZ+w9FgtTluJn
TLSH
T12F9533A10ACBE5327C7C124DD33AA3235970587CFA01D3FAE4A74653664ABF0025BCB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecHex-GUI.deps.json

Path C:\Users\Admin\Downloads\SecHex Spoofer\SecHex-GUI.deps.json
Size 61KB
SHA256 a4cadd5c4f3922a4ada9e4bbc13e2bd779280a9b8cf537b66475fb3559bc7122
MD5 64ae126cf65a9096d5730e060b448293
SHA1 621bce8056a378974cc38788bee2c3079aec7a87
SHA512 8eb0dd523d91555ff65681ebb2d482e86e8ee5c2a8842fbbb479d164981d3d398308d335f8c3ba813007c16bf738c7ae72e4eb3c9d3ec92f4f09312e09261dc2
SSDEEP 1536:9+lcu7Ll5JBuR6ML1O/1u33ZHZsSGKm6Y8:8lcu7Ll5JBuR6ML1O/1u33ZHZsSGKG8
TLSH
T1B4535626DB88ACE30AB66B961431C092F361832F51106DDE79FC118EDF77E861275B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecHex-GUI.dll

Path C:\Users\Admin\Downloads\SecHex Spoofer\SecHex-GUI.dll
Size 1.7MB
SHA256 5f4319c5b2e9eb35d203c51f7a5982b88723ea93c6658474e265ecd78d1117ee
MD5 db8e866a7ac76a7126d7f18e8dcf3825
SHA1 151ee349ce2270603aa59839a0ac52859f92116f
SHA512 5c0460b570e3dbdbe6c318167e1d27269f8942873bf319e993b81272ebb13a14c6a9d0b29351eecd88925641d145097db08549fe145f1a3963f1654e3a454abb
SSDEEP 49152:ox35IEurgBWBKH8jkDVFCNXODzWS9HfX0HI:gJIE3+KH4kpc+DX/0HI
TLSH
T1C385234033DD6746F0BDA7FEA4E094108FB27E72A622C95E0D8757DD0AA2780DA21F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecHex-GUI.exe

Path C:\Users\Admin\Downloads\SecHex Spoofer\SecHex-GUI.exe
Size 152KB
SHA256 c5ce62642117f1a8d8a2f222605f1d6ccf159d648e1466a63f4fab3a6cbf035c
MD5 2602e0338ebac653b4f9147f64b70efe
SHA1 974af7c5f735e992bbaa697887303580ba7e76da
SHA512 18f0a494e37b569ad566e478a08834ff99d228811b86bc31cd43138bc0f6ccc643863eb2d7baab9e39410fe1af2146f3c8cb8b00925822e117141c1b9f38fa3d
SSDEEP 3072:D8vbzyQ6Y1YXrbNK+3FNxacPEMk65RQA2TWBaU:DszAXNK+3FVFRQdTW8
TLSH
T1C8E34806B2AE11F8D1BBE27889A20A06F7767826473597DF1350423B0F777D09E7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecHex-GUI.runtimeconfig.json

Path C:\Users\Admin\Downloads\SecHex Spoofer\SecHex-GUI.runtimeconfig.json
Size 266B
SHA256 321b4e463bbacd6113aa337511bdebf5e7356e9971744346b28424607c7b483a
MD5 d720176a229e9d969b40fabeb0baf62e
SHA1 f2d8e97a6c6098a10dd80553eaaef7547ad32ba3
SHA512 0844f9aca147014a68248c43310bf97e0a0a3679fc84650aa0a27aa09f70f56fa071c0ace1be80f0e33ce4dd3f865eae11e946d98d21af916dc1a7f945acaba0
TLSH
T136D0A93BC9508CB328F92BB6D23AC281FF24071B11804E2A32BC000C1FB6A630100F84
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads