URL:

https://download.cdn.viber.com/desktop/windows/ViberSetup.exe

Full analysis: https://app.any.run/tasks/08d92581-a6f2-4315-a6a3-ca6006ea3517
Verdict: Malicious activity
Analysis date: March 25, 2025, 03:09:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autorun-download
evasion
Indicators:
MD5:

6527E2DE4447AF13B8E47BAE24C10727

SHA1:

85000708389B92AB9C78D45DFDA3EC9665304EE6

SHA256:

058CC7CA604060639D6E12DFAFBBE5289D0BB40FB4887A3A0E9484749AA31189

SSDEEP:

3:N8SElMLAg8W1VKSMq6lA:2SKMLj82f6lA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • ViberSetup.exe (PID: 2136)
      • ie4uinit.exe (PID: 7684)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • ViberSetup.exe (PID: 2136)
      • msiexec.exe (PID: 4112)

    • Executable content was dropped or overwritten

      • ViberSetup.exe (PID: 2136)
      • rundll32.exe (PID: 1512)

    • Reads security settings of Internet Explorer

      • ViberBA.exe (PID: 6036)
      • ViberSetup.exe (PID: 2136)

    • Creates a software uninstall entry

      • ViberSetup.exe (PID: 2136)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4112)

    • Checks for external IP

      • ViberBA.exe (PID: 6036)
      • Viber.exe (PID: 4408)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 4112)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 7996)

    • Searches for installed software

      • ViberSetup.exe (PID: 2136)

    • Detected use of alternative data streams (AltDS)

      • Viber.exe (PID: 4408)

  • INFO

    • Autorun file from Downloads

      • chrome.exe (PID: 2140)
      • chrome.exe (PID: 7820)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2140)
      • msiexec.exe (PID: 4112)
      • chrome.exe (PID: 496)

    • The sample compiled with english language support

      • ViberSetup.exe (PID: 2136)
      • chrome.exe (PID: 2140)
      • msiexec.exe (PID: 4112)
      • chrome.exe (PID: 496)

    • Creates files or folders in the user directory

      • ViberBA.exe (PID: 6036)
      • ViberSetup.exe (PID: 2136)
      • msiexec.exe (PID: 4112)
      • ie4uinit.exe (PID: 7684)
      • Viber.exe (PID: 4408)

    • Create files in a temporary directory

      • ViberSetup.exe (PID: 2136)
      • rundll32.exe (PID: 1512)
      • Viber.exe (PID: 4408)

    • Reads the computer name

      • ViberBA.exe (PID: 6036)
      • ViberSetup.exe (PID: 2136)
      • msiexec.exe (PID: 4112)
      • msiexec.exe (PID: 960)
      • msiexec.exe (PID: 4436)
      • Viber.exe (PID: 4408)

    • Creates files in the program directory

      • ViberBA.exe (PID: 6036)

    • Reads the machine GUID from the registry

      • ViberBA.exe (PID: 6036)
      • ViberSetup.exe (PID: 2136)
      • msiexec.exe (PID: 4112)
      • Viber.exe (PID: 4408)

    • Checks supported languages

      • ViberBA.exe (PID: 6036)
      • ViberSetup.exe (PID: 2136)
      • msiexec.exe (PID: 4112)
      • msiexec.exe (PID: 960)
      • msiexec.exe (PID: 4436)
      • Viber.exe (PID: 4408)

    • Disables trace logs

      • ViberBA.exe (PID: 6036)

    • Checks proxy server information

      • ViberBA.exe (PID: 6036)
      • ViberSetup.exe (PID: 2136)
      • Viber.exe (PID: 4408)
      • slui.exe (PID: 7036)

    • Application launched itself

      • chrome.exe (PID: 2140)
      • msiexec.exe (PID: 4112)

    • Reads the software policy settings

      • ViberBA.exe (PID: 6036)
      • slui.exe (PID: 7948)
      • ViberSetup.exe (PID: 2136)
      • msiexec.exe (PID: 4112)
      • Viber.exe (PID: 4408)
      • slui.exe (PID: 7036)

    • Reads Environment values

      • msiexec.exe (PID: 4112)
      • Viber.exe (PID: 4408)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 7996)
      • ie4uinit.exe (PID: 7684)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4112)

    • Qt framework related mutex has been found

      • Viber.exe (PID: 4408)

    • Process checks computer location settings

      • Viber.exe (PID: 4408)

    • Reads the time zone

      • Viber.exe (PID: 4408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
29
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs vibersetup.exe viberba.exe slui.exe msiexec.exe chrome.exe no specs msiexec.exe no specs rundll32.exe msiexec.exe no specs ie4uinit.exe no specs rundll32.exe no specs ie4uinit.exe chrome.exe no specs viber.exe chrome.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3544 --field-trial-handle=1836,i,8297149608170643748,14975982702058114218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
812"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5616 --field-trial-handle=1836,i,8297149608170643748,14975982702058114218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
960C:\Windows\syswow64\MsiExec.exe -Embedding CDF1EDC23C21D03A79EC2FAC972F6C1BC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1512rundll32.exe "C:\WINDOWS\Installer\MSIE2EB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1172328 2 ViberCustomActions!ViberCustomActions.KillViberCustomAction.KillViberC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2084"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5840 --field-trial-handle=1836,i,8297149608170643748,14975982702058114218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2136"C:\Users\admin\Downloads\ViberSetup.exe" C:\Users\admin\Downloads\ViberSetup.exe
chrome.exe
User:
admin
Company:
2010-2025 Viber Media S.a.r.l
Integrity Level:
MEDIUM
Description:
Viber
Exit code:
0
Version:
24.9.2.0
Modules
Images
c:\users\admin\downloads\vibersetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2140"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints "https://download.cdn.viber.com/desktop/windows/ViberSetup.exe"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4112C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4408"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5264 --field-trial-handle=1836,i,8297149608170643748,14975982702058114218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4408"C:\Users\admin\AppData\Local\Viber\Viber.exe" AfterInstallation BurnInstallerC:\Users\admin\AppData\Local\Viber\Viber.exe
ViberBA.exe
User:
admin
Company:
Viber Media S.à r.l.
Integrity Level:
MEDIUM
Description:
Viber
Version:
24.9.2-0-g4f6f94c4f6
Modules
Images
c:\users\admin\appdata\local\viber\viber.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
Total events
46 761
Read events
46 177
Write events
560
Delete events
24

Modification events

(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2140) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2140) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(7820) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
010000000000000064C78B66339DDB01
(PID) Process:(6036) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6036) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6036) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6036) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
119
Suspicious files
173
Text files
64
Unknown types
0

Dropped files

PID
Process
Filename
Type
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c2d5.TMP —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10c2e4.TMP —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10c2e4.TMP —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c2e4.TMP —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10c2f4.TMP —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
57
DNS requests
49
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4464
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmztx7tk73bjttcb4b6ys6fixq_2025.1.3.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.1.3.1202_all_afljkosaafpr5gqm7ftppqz7zq.crx3
unknown
—
—
whitelisted
4464
svchost.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmztx7tk73bjttcb4b6ys6fixq_2025.1.3.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.1.3.1202_all_afljkosaafpr5gqm7ftppqz7zq.crx3
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7736
backgroundTaskHost.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2140
chrome.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
2140
chrome.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAJP0xH3s%2BBMqM0zUi31yTc%3D
unknown
—
—
whitelisted
2140
chrome.exe
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
—
—
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2104
svchost.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2140
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
7316
chrome.exe
13.227.219.18:443
download.cdn.viber.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.168.206
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.18.121.147
whitelisted
download.cdn.viber.com
  • 13.227.219.18
whitelisted
accounts.google.com
  • 142.250.102.84
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
sb-ssl.google.com
  • 142.251.39.110
whitelisted
login.live.com
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 104.78.173.167
whitelisted
www.google.com
  • 142.251.36.36
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6036
ViberBA.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
4408
Viber.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.cdn.viber.com/desktop/windows/ViberSetup.exe