File name:

Walliant.zip

Full analysis: https://app.any.run/tasks/e240b602-f8ec-4283-945e-8549946a45e8
Verdict: Malicious activity
Analysis date: October 23, 2023, 18:21:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

33968A33F7E098D31920C07E56C66DE2

SHA1:

9C684A0DADAE9F940DD40D8D037FAA6ADDF22DDB

SHA256:

6364269DBDC73D638756C2078ECB1A39296DDD12B384D05121045F95D357D504

SSDEEP:

98304:QXEXw3QBAg+V40y49wQ2pFQ0xxYtroaNrZaYzu9:kEA3AAg+Vt9V81xxYtfNLO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ska2pwej.aeh.exe (PID: 1848)
      • ska2pwej.aeh.tmp (PID: 2824)
      • xkzpbcqh.exe (PID: 3852)
      • walliant.exe (PID: 3808)
      • xkzpbcqh.tmp (PID: 976)

    • Application was dropped or rewritten from another process

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)
      • xkzpbcqh.exe (PID: 3852)

    • Loads dropped or rewritten executable

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Changes the autorun value in the registry

      • Walliant.exe (PID: 3812)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • ska2pwej.aeh.tmp (PID: 2824)
      • walliant.exe (PID: 3808)
      • xkzpbcqh.tmp (PID: 976)
      • Walliant.exe (PID: 3812)

    • Reads the Windows owner or organization settings

      • ska2pwej.aeh.tmp (PID: 2824)
      • xkzpbcqh.tmp (PID: 976)

    • Process drops legitimate windows executable

      • ska2pwej.aeh.tmp (PID: 2824)
      • xkzpbcqh.tmp (PID: 976)

    • Checks Windows Trust Settings

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Reads the Internet Settings

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Reads Microsoft Outlook installation path

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Reads security settings of Internet Explorer

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Searches for installed software

      • xkzpbcqh.tmp (PID: 976)

    • Reads Internet Explorer settings

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

  • INFO

    • Checks supported languages

      • ska2pwej.aeh.exe (PID: 1848)
      • ska2pwej.aeh.tmp (PID: 2824)
      • walliant.exe (PID: 3808)
      • xkzpbcqh.tmp (PID: 976)
      • xkzpbcqh.exe (PID: 3852)
      • Walliant.exe (PID: 3812)

    • Create files in a temporary directory

      • ska2pwej.aeh.exe (PID: 1848)
      • xkzpbcqh.exe (PID: 3852)
      • walliant.exe (PID: 3808)
      • xkzpbcqh.tmp (PID: 976)

    • Reads the computer name

      • ska2pwej.aeh.tmp (PID: 2824)
      • walliant.exe (PID: 3808)
      • xkzpbcqh.tmp (PID: 976)
      • Walliant.exe (PID: 3812)

    • Reads the machine GUID from the registry

      • ska2pwej.aeh.tmp (PID: 2824)
      • walliant.exe (PID: 3808)
      • xkzpbcqh.tmp (PID: 976)
      • Walliant.exe (PID: 3812)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 556)

    • Application was dropped or rewritten from another process

      • ska2pwej.aeh.tmp (PID: 2824)

    • Creates files or folders in the user directory

      • ska2pwej.aeh.tmp (PID: 2824)
      • walliant.exe (PID: 3808)
      • xkzpbcqh.tmp (PID: 976)

    • Reads Environment values

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Reads product name

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Checks proxy server information

      • walliant.exe (PID: 3808)
      • Walliant.exe (PID: 3812)

    • Manual execution by a user

      • chrome.exe (PID: 1692)

    • Application launched itself

      • chrome.exe (PID: 1692)
      • chrome.exe (PID: 3340)
      • msedge.exe (PID: 3748)

    • Reads the time zone

      • Walliant.exe (PID: 3812)

    • The process uses the downloaded file

      • chrome.exe (PID: 2880)
      • chrome.exe (PID: 1144)
      • chrome.exe (PID: 1032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ska2pwej.aeh.exe
ZipUncompressedSize: 5293448
ZipCompressedSize: 4747047
ZipCRC: 0x4b786beb
ZipModifyDate: 2022:06:23 18:56:34
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
49
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winrar.exe no specs ska2pwej.aeh.exe no specs ska2pwej.aeh.tmp walliant.exe xkzpbcqh.exe no specs xkzpbcqh.tmp walliant.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4340 --field-trial-handle=1164,i,8662241861587882323,18235674275203781155,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
556"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Walliant.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
976"C:\Users\admin\AppData\Local\Temp\is-G9IQ0.tmp\xkzpbcqh.tmp" /SL5="$13012C,5010045,830976,C:\Users\admin\AppData\Local\Temp\xkzpbcqh.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTARTC:\Users\admin\AppData\Local\Temp\is-G9IQ0.tmp\xkzpbcqh.tmp
xkzpbcqh.exe
User:
admin
Company:
Walliant
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g9iq0.tmp\xkzpbcqh.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1032"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 --field-trial-handle=1164,i,8662241861587882323,18235674275203781155,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
1144"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=1164,i,8662241861587882323,18235674275203781155,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
1396"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1504 --field-trial-handle=1164,i,8662241861587882323,18235674275203781155,131072 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1692"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1764"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\chrome-runner2670878196" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=984 --field-trial-handle=1148,i,100442801975069013,2121862925999964396,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1848"C:\Users\admin\AppData\Local\Temp\Rar$EXb556.30264\ska2pwej.aeh.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb556.30264\ska2pwej.aeh.exe—WinRAR.exe
User:
admin
Company:
Walliant
Integrity Level:
MEDIUM
Description:
Walliant Setup
Exit code:
0
Version:
1.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb556.30264\ska2pwej.aeh.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2096"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --mute-audio --ignore-certificate-errors --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Temp\chrome-runner2812944890" --mojo-platform-channel-handle=1380 --field-trial-handle=1308,i,947365802224771944,17028331048590010273,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
Total events
26 855
Read events
26 602
Write events
237
Delete events
16

Modification events

(PID) Process:(556) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(556) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
40
Suspicious files
504
Text files
96
Unknown types
57

Dropped files

PID
Process
Filename
Type
1848ska2pwej.aeh.exeC:\Users\admin\AppData\Local\Temp\is-H2A7B.tmp\ska2pwej.aeh.tmpexecutable
MD5:62E5DBC52010C304C82ADA0AC564EFF9
SHA256:BD54AD7A25594DC823572D9B23A3490FF6B8B1742A75E368D110421AB08909B2
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\AsyncBridge.Net35.dllexecutable
MD5:35CBDBE6987B9951D3467DDA2F318F3C
SHA256:E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\unins000.exeexecutable
MD5:62E5DBC52010C304C82ADA0AC564EFF9
SHA256:BD54AD7A25594DC823572D9B23A3490FF6B8B1742A75E368D110421AB08909B2
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-VEDBU.tmpexecutable
MD5:60D3737A1F84758238483D865A3056DC
SHA256:3436C29DEC2C7F633F4766ACAF334F6C395D70EA6180C0EA7C1610591D5D89B9
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-GCS4O.tmpxml
MD5:B492287271363085810EF581A1BE0FA3
SHA256:A5FCCA5B80F200E9A3FF358D9CAC56A0FFABB6F26D97DA7F850DE14F0FB2709E
556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb556.30264\ska2pwej.aeh.exeexecutable
MD5:929335D847F8265C0A8648DD6D593605
SHA256:6613ACB18CB8BF501FBA619F04F8298E5E633CB220C450212BBC9DD2BEF9538D
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-0LVRI.tmpexecutable
MD5:BF6A0F5D2D5F54CEB5B899A2172A335B
SHA256:32EF07A1A2954A40436D625814D0CE0E04F4A45E711BEEBC7E159D4C1B2556B6
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-I0CLF.tmpexecutable
MD5:FDDC7534F3281FEB4419DA7404D89B4C
SHA256:F13DA9813FA11B81EE4180794CBAD2B280422716A080BF4C0791996BE7F7908E
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\Countly.dllexecutable
MD5:BF6A0F5D2D5F54CEB5B899A2172A335B
SHA256:32EF07A1A2954A40436D625814D0CE0E04F4A45E711BEEBC7E159D4C1B2556B6
2824ska2pwej.aeh.tmpC:\Users\admin\AppData\Local\Programs\Walliant\is-VP3GT.tmpexecutable
MD5:62E5DBC52010C304C82ADA0AC564EFF9
SHA256:BD54AD7A25594DC823572D9B23A3490FF6B8B1742A75E368D110421AB08909B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
128
DNS requests
215
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
864
svchost.exe
HEAD
—
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
—
—
unknown
864
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA
unknown
—
—
unknown
2300
chrome.exe
GET
200
2.19.198.26:80
http://aia.entrust.net/l1m-chain256.cer
unknown
binary
1.30 Kb
unknown
864
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA
unknown
binary
44.1 Kb
unknown
864
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA
unknown
binary
18.9 Kb
unknown
3808
walliant.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?78f1aa4193cd9e35
unknown
compressed
61.6 Kb
unknown
3808
walliant.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6aca543146ff7887
unknown
compressed
61.6 Kb
unknown
864
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA
unknown
binary
11.1 Kb
unknown
864
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA
unknown
binary
16.0 Kb
unknown
864
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/EWvH2e-LS80S29cxzuTfRA
unknown
binary
8.07 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2824
ska2pwej.aeh.tmp
104.21.57.77:443
stats.walliant.com
CLOUDFLARENET
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3808
walliant.exe
188.114.97.3:443
cheverel.net
CLOUDFLARENET
NL
unknown
3808
walliant.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3808
walliant.exe
104.21.57.77:443
stats.walliant.com
CLOUDFLARENET
—
unknown
3808
walliant.exe
104.16.123.96:443
www.cloudflare.com
CLOUDFLARENET
—
unknown
3808
walliant.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3808
walliant.exe
2.21.20.218:443
img-prod-cms-rt-microsoft-com.akamaized.net
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
stats.walliant.com
  • 104.21.57.77
  • 172.67.189.175
unknown
cheverel.net
  • 188.114.97.3
  • 188.114.96.3
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
www.cloudflare.com
  • 104.16.123.96
  • 104.16.124.96
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
img-prod-cms-rt-microsoft-com.akamaized.net
  • 2.21.20.218
  • 2.21.20.220
whitelisted
update.walliant.com
  • 172.67.189.175
  • 104.21.57.77
unknown
track.walliant.com
  • 172.67.189.175
  • 104.21.57.77
unknown
clientservices.googleapis.com
  • 172.217.20.67
whitelisted
accounts.google.com
  • 142.250.187.173
  • 142.251.140.77
shared

Threats

PID
Process
Class
Message
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2300
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chrome-runner2670878196 directory exists )
chrome.exe
Too long restart command line passed
chrome.exe
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chrome-runner2812944890 directory exists )
msedge.exe
Too long restart command line passed
msedge.exe
msedge.exe
Error -
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Walliant.zip