File name:

WinDjView-2.1-Setup.exe

Full analysis: https://app.any.run/tasks/914e986a-9a2f-44b9-8117-c49056f4b07e
Verdict: Malicious activity
Analysis date: May 11, 2025, 16:14:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

C838F4233C838CE7CB8D22E6EFDF9F23

SHA1:

B595EF472E50BC70A6B2A2991516775BF0D36E26

SHA256:

C46A0B6B2C1C289B99FC92212443C911B80A899DDC772442E1A47264C9039C5C

SSDEEP:

98304:VJ8AyMUwJbX6C4xnqiRlBTvhWXJJLmIehujDYEht4pC4zwkp35sfeaMwpV44BP14:VquHVKx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Executable content was dropped or overwritten

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • There is functionality for taking screenshot (YARA)

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Application launched itself

      • WinDjView-2.1-Setup.exe (PID: 4220)

    • Reads security settings of Internet Explorer

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView.exe (PID: 7872)

    • Creates a software uninstall entry

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Searches for installed software

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • The process creates files with name similar to system file names

      • WinDjView-2.1-Setup.exe (PID: 7204)

  • INFO

    • The sample compiled with english language support

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Create files in a temporary directory

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Process checks whether UAC notifications are on

      • WinDjView-2.1-Setup.exe (PID: 4220)

    • Process checks computer location settings

      • WinDjView-2.1-Setup.exe (PID: 4220)

    • Checks supported languages

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)
      • WinDjView.exe (PID: 7748)
      • WinDjView.exe (PID: 7872)

    • Reads the computer name

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)
      • WinDjView.exe (PID: 7872)

    • Creates files in the program directory

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Checks proxy server information

      • WinDjView.exe (PID: 7872)

    • Reads the machine GUID from the registry

      • WinDjView.exe (PID: 7872)

    • Creates files or folders in the user directory

      • WinDjView.exe (PID: 7872)

    • Reads the software policy settings

      • WinDjView.exe (PID: 7872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Andrew Zhezherun
CompanyWebsite: http://windjview.sourceforge.net
FileDescription: WinDjView Setup
FileVersion: 2.1
LegalCopyright: Copyright (C) 2004-2015 Andrew Zhezherun
ProductName: WinDjView Setup
ProductVersion: 2.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windjview-2.1-setup.exe windjview-2.1-setup.exe sppextcomobj.exe no specs slui.exe no specs windjview.exe no specs windjview.exe

Process information

PID
CMD
Path
Indicators
Parent process
4220"C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe" C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe
explorer.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7204"C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe" /UAC:40264 /NCRC C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7256C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7304"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7748"C:\Program Files\WinDjView\WinDjView.exe" /RegisterFileTypesC:\Program Files\WinDjView\WinDjView.exe—WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView
Exit code:
0
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7872"C:\Program Files\WinDjView\WinDjView.exe"C:\Program Files\WinDjView\WinDjView.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
c:\windows\system32\win32u.dll
Total events
1 369
Read events
1 351
Write events
18
Delete events
0

Modification events

(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallerLanguage
Value:
1033
(PID) Process:(7748) WinDjView.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
18
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayName
Value:
WinDjView 2.1
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayIcon
Value:
C:\Program Files\WinDjView\WinDjView.exe
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayVersion
Value:
2.1
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:Publisher
Value:
Andrew Zhezherun
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLInfoAbout
Value:
http://windjview.sourceforge.net
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLUpdateInfo
Value:
http://windjview.sourceforge.net
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallLocation
Value:
C:\Program Files\WinDjView
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:UninstallString
Value:
C:\Program Files\WinDjView\uninstall.exe
Executable files
7
Suspicious files
6
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5A.tmp —
MD5:—
SHA256:—
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5B.tmp\modern-wizard.bmpimage
MD5:5F2E3EA2FD0E5260BD01EA7DC1D675AE
SHA256:B7C3714932DB101EB0E38465F352C213D03288A18406800009D05186D8EE6230
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5B.tmp\LangDLL.dllexecutable
MD5:68B287F4067BA013E34A1339AFDB1EA8
SHA256:18E8B40BA22C7A1687BD16E8D585380BC2773FFF5002D7D67E9485FCC0C51026
7204WinDjView-2.1-Setup.exeC:\Program Files\WinDjView\WinDjView.exeexecutable
MD5:89CDA5298A56FAAE6EF3F7D9B4979330
SHA256:D1049EFEF77554446171BA94C69CEE78BB6B0B9FDADE3E1B5DC93468DA6CE0C0
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5B.tmp\UAC.dllexecutable
MD5:113C5F02686D865BC9E8332350274FD1
SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
7204WinDjView-2.1-Setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView\Uninstall WinDjView.lnkbinary
MD5:98812FD2E6A809978D0B8E5D28F56371
SHA256:0C9F70FDC97C71F6352E5BA17D7AC769C483DC1EC13AD080B77BF0F19509DE27
7204WinDjView-2.1-Setup.exeC:\Program Files\WinDjView\uninstall.exeexecutable
MD5:CED559B56E9EDCBBE1EC6D0A1E8B1251
SHA256:A8BAF99098E0D173A384A3798DB83E437B52887DCB784E4C522AA465261737C0
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5B.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
7872WinDjView.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
4220WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsuB4AE.tmp\UAC.dllexecutable
MD5:113C5F02686D865BC9E8332350274FD1
SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
25
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7872
WinDjView.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7872
WinDjView.exe
GET
301
104.18.13.149:80
http://windjview.sourceforge.net/version.txt
unknown
—
—
whitelisted
8008
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8008
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.146
  • 23.48.23.147
  • 23.48.23.150
  • 23.48.23.142
  • 23.48.23.149
  • 23.48.23.148
  • 23.48.23.145
  • 23.48.23.143
  • 23.48.23.141
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.64
  • 40.126.32.133
  • 20.190.160.2
  • 40.126.32.134
  • 20.190.160.132
  • 20.190.160.22
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
windjview.sourceforge.net
  • 104.18.13.149
  • 104.18.12.149
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
windjview.sourceforge.io
  • 104.18.10.31
  • 104.18.11.31
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDjView-2.1-Setup.exe