File name:

WinDjView-2.1-Setup.exe

Full analysis: https://app.any.run/tasks/ec42c8c0-7525-40cb-a995-b62eb8e8899c
Verdict: Malicious activity
Analysis date: August 05, 2024, 08:17:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

C838F4233C838CE7CB8D22E6EFDF9F23

SHA1:

B595EF472E50BC70A6B2A2991516775BF0D36E26

SHA256:

C46A0B6B2C1C289B99FC92212443C911B80A899DDC772442E1A47264C9039C5C

SSDEEP:

98304:VJ8AyMUwJbX6C4xnqiRlBTvhWXJJLmIehujDYEht4pC4zwkp35sfeaMwpV44BP14:VquHVKx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView-2.1-Setup.exe (PID: 6200)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Reads security settings of Internet Explorer

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView.exe (PID: 5552)

    • Reads the date of Windows installation

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Application launched itself

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • The process creates files with name similar to system file names

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Creates a software uninstall entry

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Searches for installed software

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Checks Windows Trust Settings

      • WinDjView.exe (PID: 5552)

  • INFO

    • Process checks whether UAC notifications are on

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Reads the computer name

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView-2.1-Setup.exe (PID: 6200)
      • WinDjView.exe (PID: 5552)

    • Checks supported languages

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView-2.1-Setup.exe (PID: 6200)
      • WinDjView.exe (PID: 5552)
      • WinDjView.exe (PID: 4664)

    • Process checks computer location settings

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Create files in a temporary directory

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Creates files in the program directory

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Creates files or folders in the user directory

      • WinDjView.exe (PID: 5552)

    • Checks proxy server information

      • WinDjView.exe (PID: 5552)

    • Reads the software policy settings

      • WinDjView.exe (PID: 5552)

    • Reads the machine GUID from the registry

      • WinDjView.exe (PID: 5552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Andrew Zhezherun
CompanyWebsite: http://windjview.sourceforge.net
FileDescription: WinDjView Setup
FileVersion: 2.1
LegalCopyright: Copyright (C) 2004-2015 Andrew Zhezherun
ProductName: WinDjView Setup
ProductVersion: 2.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windjview-2.1-setup.exe windjview-2.1-setup.exe windjview.exe no specs windjview.exe

Process information

PID
CMD
Path
Indicators
Parent process
4664"C:\Program Files\WinDjView\WinDjView.exe" /RegisterFileTypesC:\Program Files\WinDjView\WinDjView.exe—WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView
Exit code:
0
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5552"C:\Program Files\WinDjView\WinDjView.exe"C:\Program Files\WinDjView\WinDjView.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\version.dll
6200"C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe" /UAC:4035A /NCRC C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\desktop\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6988"C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe" C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe
explorer.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\desktop\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
10 930
Read events
10 828
Write events
99
Delete events
3

Modification events

(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallerLanguage
Value:
1033
(PID) Process:(4664) WinDjView.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
17
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayName
Value:
WinDjView 2.1
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayIcon
Value:
C:\Program Files\WinDjView\WinDjView.exe
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayVersion
Value:
2.1
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:Publisher
Value:
Andrew Zhezherun
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLInfoAbout
Value:
http://windjview.sourceforge.net
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLUpdateInfo
Value:
http://windjview.sourceforge.net
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallLocation
Value:
C:\Program Files\WinDjView
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:UninstallString
Value:
C:\Program Files\WinDjView\uninstall.exe
Executable files
7
Suspicious files
5
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53F9.tmp —
MD5:—
SHA256:—
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53FA.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
6200WinDjView-2.1-Setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView\WinDjView Website.urltext
MD5:0E959BDC951AA9BE23D50BEF5457542D
SHA256:7D13FE8DD20CD55A88E986BCBB6F99DD3B3AA4C3D55B85E3C0B7C5B4667EF604
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53FA.tmp\modern-header.bmpimage
MD5:852B07C25E75B8A5356931C91C834EFC
SHA256:BD146E39AF28CEC251D63DA453CB8F04B74904A643F4C3DAB52EF2B5BCB4BB3A
6200WinDjView-2.1-Setup.exeC:\Program Files\WinDjView\uninstall.exeexecutable
MD5:CED559B56E9EDCBBE1EC6D0A1E8B1251
SHA256:A8BAF99098E0D173A384A3798DB83E437B52887DCB784E4C522AA465261737C0
6200WinDjView-2.1-Setup.exeC:\Program Files\WinDjView\WinDjView.exeexecutable
MD5:89CDA5298A56FAAE6EF3F7D9B4979330
SHA256:D1049EFEF77554446171BA94C69CEE78BB6B0B9FDADE3E1B5DC93468DA6CE0C0
5552WinDjView.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\version[1].htmhtml
MD5:BB3039D34FE56D52754AEAE88872EA6D
SHA256:FDA53E16A92CD675F42943EA62A25FF02619195ABDF00CEF41C897EC9535AF69
6200WinDjView-2.1-Setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView\Uninstall WinDjView.lnkbinary
MD5:A778775D86C61B4C9F32C980AA365E99
SHA256:FB7D2C2C5276C0836ECD49A68A741C9822746FFC3FE3CE1B8DF9B1561DEE42E5
5552WinDjView.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:F125ABD02111F54572C290CF9EDC2E35
SHA256:35F9C59D8EEABAAED01CF609489F5F690201B0465A8729C0801DD039648465CD
6988WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nst5178.tmpbinary
MD5:6170CD46231FEB3C4192A611869B1AB2
SHA256:0AFBCC63F1639DF90D253FDB04EDC878E0FD8FAFC1DDCBFF6211E2E9F17814A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
42
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5244
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6704
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5552
WinDjView.exe
GET
301
104.18.12.149:80
http://windjview.sourceforge.net/version.txt
unknown
—
—
whitelisted
5552
WinDjView.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
—
—
whitelisted
6744
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4708
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2680
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5336
SearchApp.exe
95.100.146.35:443
www.bing.com
Akamai International B.V.
CZ
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5244
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5244
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 95.100.146.35
  • 95.100.146.32
  • 95.100.146.40
  • 95.100.146.27
  • 95.100.146.34
  • 95.100.146.19
  • 95.100.146.33
  • 95.100.146.17
  • 95.100.146.26
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.73
  • 40.126.31.67
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
th.bing.com
  • 95.100.146.16
  • 95.100.146.40
  • 95.100.146.35
  • 95.100.146.34
  • 95.100.146.8
  • 95.100.146.33
  • 95.100.146.10
  • 95.100.146.17
  • 95.100.146.19
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
windjview.sourceforge.net
  • 104.18.12.149
  • 104.18.13.149
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDjView-2.1-Setup.exe