File name:

ViberSetup.exe

Full analysis: https://app.any.run/tasks/0d97ed94-0b74-4270-8ad1-358e7a1c36f4
Verdict: Malicious activity
Analysis date: July 11, 2025, 11:55:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

32FAC0F6ED6D9CF83F1324FD061C5DDA

SHA1:

02E427D2F64CCEE44633DCDEB4B64E0FDE256F07

SHA256:

711B7C177309A4B6FCCFD21184356B483688D7B4B790D0BD686B55E8FA102C29

SSDEEP:

98304:PlyTSNHO/KXuqp0p+HDSN0eg/Byas3PI9g81qwK1VHY6f1HGbJmIsr73XoLjcX5N:3ST

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • ViberSetup.exe (PID: 2972)
      • ie4uinit.exe (PID: 3704)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ViberSetup.exe (PID: 2972)
      • rundll32.exe (PID: 6756)

    • Searches for installed software

      • ViberSetup.exe (PID: 2972)

    • Process drops legitimate windows executable

      • ViberSetup.exe (PID: 2972)
      • msiexec.exe (PID: 1688)

    • Checks for external IP

      • ViberBA.exe (PID: 2780)

    • Reads security settings of Internet Explorer

      • ViberBA.exe (PID: 2780)
      • ViberSetup.exe (PID: 2972)

    • Creates a software uninstall entry

      • ViberSetup.exe (PID: 2972)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 1688)

    • Application launched itself

      • msiexec.exe (PID: 1688)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 5952)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 1688)

    • Connects to unusual port

      • Viber.exe (PID: 424)

    • Detected use of alternative data streams (AltDS)

      • Viber.exe (PID: 424)

  • INFO

    • The sample compiled with english language support

      • ViberSetup.exe (PID: 2972)
      • msiexec.exe (PID: 1688)

    • Checks proxy server information

      • ViberBA.exe (PID: 2780)
      • ViberSetup.exe (PID: 2972)
      • Viber.exe (PID: 424)

    • Reads the computer name

      • ViberSetup.exe (PID: 2972)
      • msiexec.exe (PID: 6128)
      • msiexec.exe (PID: 1688)
      • Viber.exe (PID: 424)
      • msiexec.exe (PID: 5724)
      • ViberBA.exe (PID: 2780)

    • Checks supported languages

      • ViberSetup.exe (PID: 2972)
      • ViberBA.exe (PID: 2780)
      • msiexec.exe (PID: 6128)
      • msiexec.exe (PID: 1688)
      • Viber.exe (PID: 424)
      • msiexec.exe (PID: 5724)

    • Create files in a temporary directory

      • ViberSetup.exe (PID: 2972)
      • rundll32.exe (PID: 6756)
      • Viber.exe (PID: 424)

    • Reads the machine GUID from the registry

      • ViberSetup.exe (PID: 2972)
      • msiexec.exe (PID: 1688)
      • Viber.exe (PID: 424)
      • ViberBA.exe (PID: 2780)

    • Reads the software policy settings

      • ViberSetup.exe (PID: 2972)
      • ViberBA.exe (PID: 2780)
      • msiexec.exe (PID: 1688)
      • Viber.exe (PID: 424)

    • Creates files or folders in the user directory

      • ViberSetup.exe (PID: 2972)
      • msiexec.exe (PID: 1688)
      • ie4uinit.exe (PID: 3704)
      • Viber.exe (PID: 424)
      • ViberBA.exe (PID: 2780)

    • Launching a file from a Registry key

      • ViberSetup.exe (PID: 2972)
      • ie4uinit.exe (PID: 3704)

    • Reads Environment values

      • msiexec.exe (PID: 1688)
      • Viber.exe (PID: 424)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1688)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1688)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 5952)
      • ie4uinit.exe (PID: 3704)

    • Process checks computer location settings

      • ViberBA.exe (PID: 2780)
      • Viber.exe (PID: 424)

    • Reads the time zone

      • Viber.exe (PID: 424)

    • Disables trace logs

      • ViberBA.exe (PID: 2780)

    • Creates files in the program directory

      • ViberBA.exe (PID: 2780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:04 21:45:43+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.41
CodeSize: 486912
InitializedDataSize: 414720
UninitializedDataSize: -
EntryPoint: 0x51ce0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 25.7.0.0
ProductVersionNumber: 25.7.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: 2010-2025 Viber Media S.a.r.l
FileDescription: Viber
FileVersion: 25.7.0.0
InternalName: burn
OriginalFileName: ViberSetup.exe
ProductName: Viber
ProductVersion: 25.7.0.0
LegalCopyright: Copyright (c) 2010-2025 Viber Media S.a.r.l. All rights reserved.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
11
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start vibersetup.exe viberba.exe msiexec.exe msiexec.exe no specs rundll32.exe msiexec.exe no specs ie4uinit.exe no specs rundll32.exe no specs ie4uinit.exe viber.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
424"C:\Users\admin\AppData\Local\Viber\Viber.exe" AfterInstallation BurnInstallerC:\Users\admin\AppData\Local\Viber\Viber.exe
ViberBA.exe
User:
admin
Company:
Viber Media S.à r.l.
Integrity Level:
MEDIUM
Description:
Viber
Version:
25.7.0-0-g1094e2fa254
Modules
Images
c:\users\admin\appdata\local\viber\viber.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1688C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2780"C:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\ViberBA.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E32B6BCF-BCE7-4B10-839E-BBECB23F9018} {F9B30C88-45AE-47B0-A764-4721CDF191E9}C:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\ViberBA.exe
ViberSetup.exe
User:
admin
Company:
ViberBA
Integrity Level:
MEDIUM
Description:
ViberBA
Exit code:
0
Version:
25.7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{7ea2f6fe-a112-4cae-ac24-664ae7544822}\.ba\viberba.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2972"C:\Users\admin\AppData\Local\Temp\ViberSetup.exe" C:\Users\admin\AppData\Local\Temp\ViberSetup.exe
explorer.exe
User:
admin
Company:
2010-2025 Viber Media S.a.r.l
Integrity Level:
MEDIUM
Description:
Viber
Exit code:
0
Version:
25.7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\vibersetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3704ie4uinit.exe -showC:\Windows\System32\ie4uinit.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3820C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5556C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5724C:\Windows\System32\MsiExec.exe -Embedding 19793F3C7982604DF8E913268C5D5BE5C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5952ie4uinit.exe -ClearIconCacheC:\Windows\System32\ie4uinit.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6128C:\Windows\syswow64\MsiExec.exe -Embedding 2E42386CAC1EDFF416AA02F626AEA378C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
36 028
Read events
35 475
Write events
536
Delete events
17

Modification events

(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2780) ViberBA.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ViberBA_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
113
Suspicious files
78
Text files
44
Unknown types
2

Dropped files

PID
Process
Filename
Type
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.Numerics.Vectors.dllexecutable
MD5:AAA2CBF14E06E9D3586D8A4ED455DB33
SHA256:1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.Runtime.InteropServices.RuntimeInformation.dllexecutable
MD5:82DEB78891F430007E871A35CE28FAC4
SHA256:2F141B72A2AF0458993E27559395D8A8CDB0B752D79B1703541A61E728B55237
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\ViberBA.exe.configxml
MD5:6C48E1D6846CC89CBEB1F1ACB633BF1C
SHA256:3209CEC10A4122FDE7E78E99A948F7B326A4FE5C32912ED792E93111607A9884
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.Reflection.Metadata.dllexecutable
MD5:C4EA65BD802F1CCD3EA2AD1841FD85C2
SHA256:46451E1168DD11D450AA9B6119F17CEC9A70928A40AC3C752ABF61CE809CBA6F
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\WixToolset.BootstrapperApplicationApi.dllexecutable
MD5:B025BD1A052B53AB272F9C106FC4BCEF
SHA256:701722BB7DE42022F3F1B399AA8B1E964AD0BC270DD173EF3CDC93CC0C6AB2DC
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.Memory.dllexecutable
MD5:6FB95A357A3F7E88ADE5C1629E2801F8
SHA256:8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.Buffers.dllexecutable
MD5:ECDFE8EDE869D2CCC6BF99981EA96400
SHA256:ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.ValueTuple.dllexecutable
MD5:8C9424E37A28DB7D70E7D52F0DF33CF8
SHA256:E4774AEAD2793F440E0CED6C097048423D118E0B6ED238C6FE5B456ACB07817F
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.Text.Json.dllexecutable
MD5:35B0623746E769D4122A4D7DEA5B2B68
SHA256:BDE4850D39245F9758D1346BD67AC890EEC25473B7A7171AD6E631A4C5FD4734
2972ViberSetup.exeC:\Users\admin\AppData\Local\Temp\{7EA2F6FE-A112-4CAE-AC24-664AE7544822}\.ba\System.Runtime.CompilerServices.Unsafe.dllexecutable
MD5:C610E828B54001574D86DD2ED730E392
SHA256:37768488E8EF45729BC7D9A2677633C6450042975BB96516E186DA6CB9CD0DCF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
41
DNS requests
34
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6700
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2780
ViberBA.exe
GET
200
2.17.190.73:80
http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJiUKgT2m88fZ4nxc1Lu6M%2FjvkagQUDNtsgkkPSmcKuBTuesRIUojrVjgCEAWa77443IB%2FWKk6w0CBc5o%3D
unknown
—
—
whitelisted
2780
ViberBA.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAsllCLO2YEqFaBOmVKKDvo%3D
unknown
—
—
whitelisted
2972
ViberSetup.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1688
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
1688
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAJP0xH3s%2BBMqM0zUi31yTc%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6368
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2780
ViberBA.exe
34.120.62.213:443
o4507996561014784.ingest.de.sentry.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.110
whitelisted
o4507996561014784.ingest.de.sentry.io
  • 34.120.62.213
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.64
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
api64.ipify.org
  • 173.231.16.77
  • 104.237.62.213
unknown
status.rapidssl.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2780
ViberBA.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ViberSetup.exe