URL:

www.sdcx-tech.com

Full analysis: https://app.any.run/tasks/3ffad738-f9d4-4c87-9310-e3c5118cbbbc
Verdict: Malicious activity
Analysis date: March 05, 2025, 03:50:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

C430C99BE7E119D866E4091ECBCE24E8

SHA1:

1ED9696D16271FBFEE2AA1BBC716EB1B8CF66337

SHA256:

86C8359E34003FC8CFE237B12291AE22CCA310699E1D11E62848BACB62666495

SSDEEP:

3:EomG4T:nmv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • SDTech Options Setup 1.0.3.exe (PID: 7824)
      • SDTech Options Setup 1.0.3.exe (PID: 6828)

    • The process creates files with name similar to system file names

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • Executable content was dropped or overwritten

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • Reads security settings of Internet Explorer

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • Application launched itself

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options.exe (PID: 1748)

    • Drops 7-zip archiver for unpacking

      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • There is functionality for taking screenshot (YARA)

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • Process drops legitimate windows executable

      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • Creates a software uninstall entry

      • SDTech Options Setup 1.0.3.exe (PID: 7824)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 6824)

    • Reads the software policy settings

      • slui.exe (PID: 7816)
      • slui.exe (PID: 6228)

    • Create files in a temporary directory

      • SDTech Options Setup 1.0.3.exe (PID: 7824)
      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options.exe (PID: 1748)

    • Reads the computer name

      • SDTech Options Setup 1.0.3.exe (PID: 7824)
      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options.exe (PID: 1748)
      • SDTech Options.exe (PID: 7896)
      • SDTech Options.exe (PID: 2384)

    • Manual execution by a user

      • WinRAR.exe (PID: 6560)
      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options.exe (PID: 1748)

    • Checks supported languages

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options Setup 1.0.3.exe (PID: 7824)
      • SDTech Options.exe (PID: 1748)
      • SDTech Options.exe (PID: 7896)
      • SDTech Options.exe (PID: 2384)
      • SDTech Options.exe (PID: 3156)

    • The sample compiled with english language support

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • Process checks computer location settings

      • SDTech Options Setup 1.0.3.exe (PID: 6828)
      • SDTech Options.exe (PID: 1748)
      • SDTech Options.exe (PID: 3156)

    • Creates files in the program directory

      • SDTech Options Setup 1.0.3.exe (PID: 7824)

    • Creates files or folders in the user directory

      • SDTech Options Setup 1.0.3.exe (PID: 7824)
      • SDTech Options.exe (PID: 2384)
      • SDTech Options.exe (PID: 1748)

    • Checks proxy server information

      • SDTech Options.exe (PID: 1748)
      • slui.exe (PID: 6228)

    • Reads the machine GUID from the registry

      • SDTech Options.exe (PID: 1748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
31
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe rundll32.exe no specs winrar.exe no specs sdtech options setup 1.0.3.exe chrome.exe no specs sdtech options setup 1.0.3.exe sdtech options.exe no specs sdtech options.exe no specs sdtech options.exe no specs sdtech options.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3456 --field-trial-handle=1892,i,12495671228910432806,15614004136389734170,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc89f1dc40,0x7ffc89f1dc4c,0x7ffc89f1dc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1748"C:\Program Files\SDTech Options\SDTech Options.exe" C:\Program Files\SDTech Options\SDTech Options.exe—explorer.exe
User:
admin
Company:
Meng
Integrity Level:
MEDIUM
Description:
SDTech Options
Exit code:
0
Version:
1.0.3
Modules
Images
c:\program files\sdtech options\sdtech options.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2384"C:\Program Files\SDTech Options\SDTech Options.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\SDTech Options" --field-trial-handle=2128,i,11486555185405639163,14417908545356467011,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:3C:\Program Files\SDTech Options\SDTech Options.exe—SDTech Options.exe
User:
admin
Company:
Meng
Integrity Level:
MEDIUM
Description:
SDTech Options
Exit code:
0
Version:
1.0.3
Modules
Images
c:\program files\sdtech options\sdtech options.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3156"C:\Program Files\SDTech Options\SDTech Options.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\SDTech Options" --app-path="C:\Program Files\SDTech Options\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2532,i,11486555185405639163,14417908545356467011,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:1C:\Program Files\SDTech Options\SDTech Options.exe—SDTech Options.exe
User:
admin
Company:
Meng
Integrity Level:
LOW
Description:
SDTech Options
Exit code:
0
Version:
1.0.3
Modules
Images
c:\program files\sdtech options\sdtech options.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
6068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3528 --field-trial-handle=1892,i,12495671228910432806,15614004136389734170,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6228C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=596 --field-trial-handle=1892,i,12495671228910432806,15614004136389734170,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5384 --field-trial-handle=1892,i,12495671228910432806,15614004136389734170,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6560"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\SDTech Options Setup 1.0.3.rar" "C:\Users\admin\Downloads\SDTech Options Setup 1.0.3\"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
10 974
Read events
10 913
Write events
36
Delete events
25

Modification events

(PID) Process:(6824) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6824) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6824) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6824) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6824) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(7852) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000CAA9CEEA818DDB01
(PID) Process:(6560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6560) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
Executable files
31
Suspicious files
288
Text files
50
Unknown types
6

Dropped files

PID
Process
Filename
Type
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10b567.TMP —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10b577.TMP —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10b577.TMP —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10b586.TMP —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10b586.TMP —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10b567.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
53
DNS requests
42
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1020
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4920
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
632
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acfvl6c5ihkzfjdzzszjnvz6ksva_20250217.732294824.14/obedbbhbpmojnkanicioggnmelmoomoc_20250217.732294824.14_all_ENUS500000_adpsnj26q26k4tn744texmtvoihq.crx3
unknown
—
—
whitelisted
632
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acfvl6c5ihkzfjdzzszjnvz6ksva_20250217.732294824.14/obedbbhbpmojnkanicioggnmelmoomoc_20250217.732294824.14_all_ENUS500000_adpsnj26q26k4tn744texmtvoihq.crx3
unknown
—
—
whitelisted
4920
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
632
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acfvl6c5ihkzfjdzzszjnvz6ksva_20250217.732294824.14/obedbbhbpmojnkanicioggnmelmoomoc_20250217.732294824.14_all_ENUS500000_adpsnj26q26k4tn744texmtvoihq.crx3
unknown
—
—
whitelisted
632
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acfvl6c5ihkzfjdzzszjnvz6ksva_20250217.732294824.14/obedbbhbpmojnkanicioggnmelmoomoc_20250217.732294824.14_all_ENUS500000_adpsnj26q26k4tn744texmtvoihq.crx3
unknown
—
—
whitelisted
632
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acfvl6c5ihkzfjdzzszjnvz6ksva_20250217.732294824.14/obedbbhbpmojnkanicioggnmelmoomoc_20250217.732294824.14_all_ENUS500000_adpsnj26q26k4tn744texmtvoihq.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6824
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
6268
chrome.exe
108.177.119.84:443
accounts.google.com
GOOGLE
US
whitelisted
6268
chrome.exe
101.33.5.30:443
www.sdcx-tech.com
Tencent Building, Kejizhongyi Avenue
ID
unknown
6268
chrome.exe
101.33.5.30:80
www.sdcx-tech.com
Tencent Building, Kejizhongyi Avenue
ID
unknown
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.sdcx-tech.com
  • 101.33.5.30
  • 101.33.17.73
  • 211.152.149.209
  • 172.235.157.124
  • 172.104.135.123
  • 43.132.64.157
  • 172.235.24.96
  • 172.235.24.97
  • 172.235.251.16
  • 43.152.24.50
  • 43.159.79.87
  • 172.233.0.133
  • 43.175.22.231
  • 172.233.140.203
  • 211.152.148.247
unknown
accounts.google.com
  • 108.177.119.84
whitelisted
www.google.com
  • 172.217.16.196
  • 142.250.186.132
whitelisted
sdcx-offline-1325334421.cos.ap-hongkong.myqcloud.com
  • 43.132.105.214
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.131
  • 40.126.32.72
  • 20.190.160.132
  • 20.190.160.130
  • 20.190.160.5
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)
—
—
Misc activity
ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)
—
—
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
www.sdcx-tech.com