File name:

WinDjView-2.1-Setup.exe

Full analysis: https://app.any.run/tasks/914e986a-9a2f-44b9-8117-c49056f4b07e
Verdict: Malicious activity
Analysis date: May 11, 2025, 16:14:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

C838F4233C838CE7CB8D22E6EFDF9F23

SHA1:

B595EF472E50BC70A6B2A2991516775BF0D36E26

SHA256:

C46A0B6B2C1C289B99FC92212443C911B80A899DDC772442E1A47264C9039C5C

SSDEEP:

98304:VJ8AyMUwJbX6C4xnqiRlBTvhWXJJLmIehujDYEht4pC4zwkp35sfeaMwpV44BP14:VquHVKx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Reads security settings of Internet Explorer

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView.exe (PID: 7872)

    • Application launched itself

      • WinDjView-2.1-Setup.exe (PID: 4220)

    • The process creates files with name similar to system file names

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • There is functionality for taking screenshot (YARA)

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Searches for installed software

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Creates a software uninstall entry

      • WinDjView-2.1-Setup.exe (PID: 7204)

  • INFO

    • Create files in a temporary directory

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Process checks whether UAC notifications are on

      • WinDjView-2.1-Setup.exe (PID: 4220)

    • Checks supported languages

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)
      • WinDjView.exe (PID: 7748)
      • WinDjView.exe (PID: 7872)

    • Process checks computer location settings

      • WinDjView-2.1-Setup.exe (PID: 4220)

    • Reads the computer name

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)
      • WinDjView.exe (PID: 7872)

    • The sample compiled with english language support

      • WinDjView-2.1-Setup.exe (PID: 4220)
      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Creates files in the program directory

      • WinDjView-2.1-Setup.exe (PID: 7204)

    • Checks proxy server information

      • WinDjView.exe (PID: 7872)

    • Reads the machine GUID from the registry

      • WinDjView.exe (PID: 7872)

    • Creates files or folders in the user directory

      • WinDjView.exe (PID: 7872)

    • Reads the software policy settings

      • WinDjView.exe (PID: 7872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Andrew Zhezherun
CompanyWebsite: http://windjview.sourceforge.net
FileDescription: WinDjView Setup
FileVersion: 2.1
LegalCopyright: Copyright (C) 2004-2015 Andrew Zhezherun
ProductName: WinDjView Setup
ProductVersion: 2.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windjview-2.1-setup.exe windjview-2.1-setup.exe sppextcomobj.exe no specs slui.exe no specs windjview.exe no specs windjview.exe

Process information

PID
CMD
Path
Indicators
Parent process
4220"C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe" C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe
explorer.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7204"C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe" /UAC:40264 /NCRC C:\Users\admin\AppData\Local\Temp\WinDjView-2.1-Setup.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7256C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7304"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7748"C:\Program Files\WinDjView\WinDjView.exe" /RegisterFileTypesC:\Program Files\WinDjView\WinDjView.exe—WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView
Exit code:
0
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7872"C:\Program Files\WinDjView\WinDjView.exe"C:\Program Files\WinDjView\WinDjView.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
c:\windows\system32\win32u.dll
Total events
1 369
Read events
1 351
Write events
18
Delete events
0

Modification events

(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallerLanguage
Value:
1033
(PID) Process:(7748) WinDjView.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
18
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayName
Value:
WinDjView 2.1
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayIcon
Value:
C:\Program Files\WinDjView\WinDjView.exe
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayVersion
Value:
2.1
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:Publisher
Value:
Andrew Zhezherun
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLInfoAbout
Value:
http://windjview.sourceforge.net
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLUpdateInfo
Value:
http://windjview.sourceforge.net
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallLocation
Value:
C:\Program Files\WinDjView
(PID) Process:(7204) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:UninstallString
Value:
C:\Program Files\WinDjView\uninstall.exe
Executable files
7
Suspicious files
6
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5A.tmp —
MD5:—
SHA256:—
7204WinDjView-2.1-Setup.exeC:\Program Files\WinDjView\WinDjView.exeexecutable
MD5:89CDA5298A56FAAE6EF3F7D9B4979330
SHA256:D1049EFEF77554446171BA94C69CEE78BB6B0B9FDADE3E1B5DC93468DA6CE0C0
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5B.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
7872WinDjView.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
7204WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsrBA5B.tmp\modern-wizard.bmpimage
MD5:5F2E3EA2FD0E5260BD01EA7DC1D675AE
SHA256:B7C3714932DB101EB0E38465F352C213D03288A18406800009D05186D8EE6230
7204WinDjView-2.1-Setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView\WinDjView.lnkbinary
MD5:30B330AA1ED21A78A919CD4801984FFE
SHA256:1C61F14F65148E3B2E081F5216AA271F00DD202EE8210E5CD3DD0C58657E67D7
7204WinDjView-2.1-Setup.exeC:\Program Files\WinDjView\uninstall.exeexecutable
MD5:CED559B56E9EDCBBE1EC6D0A1E8B1251
SHA256:A8BAF99098E0D173A384A3798DB83E437B52887DCB784E4C522AA465261737C0
7204WinDjView-2.1-Setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView\Uninstall WinDjView.lnkbinary
MD5:98812FD2E6A809978D0B8E5D28F56371
SHA256:0C9F70FDC97C71F6352E5BA17D7AC769C483DC1EC13AD080B77BF0F19509DE27
7872WinDjView.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\version[1].htmhtml
MD5:0104C301C5E02BD6148B8703D19B3A73
SHA256:446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
4220WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsuB4AD.tmpbinary
MD5:6170CD46231FEB3C4192A611869B1AB2
SHA256:0AFBCC63F1639DF90D253FDB04EDC878E0FD8FAFC1DDCBFF6211E2E9F17814A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
25
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8008
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8008
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7872
WinDjView.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7872
WinDjView.exe
GET
301
104.18.13.149:80
http://windjview.sourceforge.net/version.txt
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.146
  • 23.48.23.147
  • 23.48.23.150
  • 23.48.23.142
  • 23.48.23.149
  • 23.48.23.148
  • 23.48.23.145
  • 23.48.23.143
  • 23.48.23.141
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.64
  • 40.126.32.133
  • 20.190.160.2
  • 40.126.32.134
  • 20.190.160.132
  • 20.190.160.22
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
windjview.sourceforge.net
  • 104.18.13.149
  • 104.18.12.149
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
windjview.sourceforge.io
  • 104.18.10.31
  • 104.18.11.31
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDjView-2.1-Setup.exe