File name:

WinDjView-2.1-Setup.exe

Full analysis: https://app.any.run/tasks/ec42c8c0-7525-40cb-a995-b62eb8e8899c
Verdict: Malicious activity
Analysis date: August 05, 2024, 08:17:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

C838F4233C838CE7CB8D22E6EFDF9F23

SHA1:

B595EF472E50BC70A6B2A2991516775BF0D36E26

SHA256:

C46A0B6B2C1C289B99FC92212443C911B80A899DDC772442E1A47264C9039C5C

SSDEEP:

98304:VJ8AyMUwJbX6C4xnqiRlBTvhWXJJLmIehujDYEht4pC4zwkp35sfeaMwpV44BP14:VquHVKx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinDjView-2.1-Setup.exe (PID: 6200)
      • WinDjView-2.1-Setup.exe (PID: 6988)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView.exe (PID: 5552)

    • Executable content was dropped or overwritten

      • WinDjView-2.1-Setup.exe (PID: 6200)
      • WinDjView-2.1-Setup.exe (PID: 6988)

    • The process creates files with name similar to system file names

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Application launched itself

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Reads the date of Windows installation

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Checks Windows Trust Settings

      • WinDjView.exe (PID: 5552)

    • Creates a software uninstall entry

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Searches for installed software

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WinDjView-2.1-Setup.exe (PID: 6200)

  • INFO

    • Process checks whether UAC notifications are on

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Checks supported languages

      • WinDjView-2.1-Setup.exe (PID: 6200)
      • WinDjView.exe (PID: 4664)
      • WinDjView.exe (PID: 5552)
      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Reads the computer name

      • WinDjView-2.1-Setup.exe (PID: 6200)
      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView.exe (PID: 5552)

    • Create files in a temporary directory

      • WinDjView-2.1-Setup.exe (PID: 6988)
      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Creates files in the program directory

      • WinDjView-2.1-Setup.exe (PID: 6200)

    • Reads the machine GUID from the registry

      • WinDjView.exe (PID: 5552)

    • Checks proxy server information

      • WinDjView.exe (PID: 5552)

    • Creates files or folders in the user directory

      • WinDjView.exe (PID: 5552)

    • Process checks computer location settings

      • WinDjView-2.1-Setup.exe (PID: 6988)

    • Reads the software policy settings

      • WinDjView.exe (PID: 5552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Andrew Zhezherun
CompanyWebsite: http://windjview.sourceforge.net
FileDescription: WinDjView Setup
FileVersion: 2.1
LegalCopyright: Copyright (C) 2004-2015 Andrew Zhezherun
ProductName: WinDjView Setup
ProductVersion: 2.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windjview-2.1-setup.exe windjview-2.1-setup.exe windjview.exe no specs windjview.exe

Process information

PID
CMD
Path
Indicators
Parent process
4664"C:\Program Files\WinDjView\WinDjView.exe" /RegisterFileTypesC:\Program Files\WinDjView\WinDjView.exe—WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView
Exit code:
0
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5552"C:\Program Files\WinDjView\WinDjView.exe"C:\Program Files\WinDjView\WinDjView.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView
Version:
2.1
Modules
Images
c:\program files\windjview\windjview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\version.dll
6200"C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe" /UAC:4035A /NCRC C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe
WinDjView-2.1-Setup.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
HIGH
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\desktop\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6988"C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe" C:\Users\admin\Desktop\WinDjView-2.1-Setup.exe
explorer.exe
User:
admin
Company:
Andrew Zhezherun
Integrity Level:
MEDIUM
Description:
WinDjView Setup
Exit code:
0
Version:
2.1
Modules
Images
c:\users\admin\desktop\windjview-2.1-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
10 930
Read events
10 828
Write events
99
Delete events
3

Modification events

(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallerLanguage
Value:
1033
(PID) Process:(4664) WinDjView.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
17
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayName
Value:
WinDjView 2.1
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayIcon
Value:
C:\Program Files\WinDjView\WinDjView.exe
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:DisplayVersion
Value:
2.1
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:Publisher
Value:
Andrew Zhezherun
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLInfoAbout
Value:
http://windjview.sourceforge.net
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:URLUpdateInfo
Value:
http://windjview.sourceforge.net
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:InstallLocation
Value:
C:\Program Files\WinDjView
(PID) Process:(6200) WinDjView-2.1-Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDjView
Operation:writeName:UninstallString
Value:
C:\Program Files\WinDjView\uninstall.exe
Executable files
7
Suspicious files
5
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53F9.tmp —
MD5:—
SHA256:—
6988WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nst5179.tmp\UAC.dllexecutable
MD5:113C5F02686D865BC9E8332350274FD1
SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53FA.tmp\UAC.dllexecutable
MD5:113C5F02686D865BC9E8332350274FD1
SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53FA.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53FA.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
6200WinDjView-2.1-Setup.exeC:\Program Files\WinDjView\WinDjView.exeexecutable
MD5:89CDA5298A56FAAE6EF3F7D9B4979330
SHA256:D1049EFEF77554446171BA94C69CEE78BB6B0B9FDADE3E1B5DC93468DA6CE0C0
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53FA.tmp\modern-wizard.bmpimage
MD5:5F2E3EA2FD0E5260BD01EA7DC1D675AE
SHA256:B7C3714932DB101EB0E38465F352C213D03288A18406800009D05186D8EE6230
6200WinDjView-2.1-Setup.exeC:\Users\admin\AppData\Local\Temp\nsk53FA.tmp\modern-header.bmpimage
MD5:852B07C25E75B8A5356931C91C834EFC
SHA256:BD146E39AF28CEC251D63DA453CB8F04B74904A643F4C3DAB52EF2B5BCB4BB3A
6200WinDjView-2.1-Setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView\WinDjView.lnklnk
MD5:5502F0179B46C5310B4827586B4EF2BD
SHA256:4589E5DA0407F4D73BE3A07F2E4D035EF8025E1053D9E611ACED74D357F5C2EE
5552WinDjView.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:F125ABD02111F54572C290CF9EDC2E35
SHA256:35F9C59D8EEABAAED01CF609489F5F690201B0465A8729C0801DD039648465CD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
42
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5244
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6704
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5552
WinDjView.exe
GET
301
104.18.12.149:80
http://windjview.sourceforge.net/version.txt
unknown
—
—
whitelisted
6744
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5552
WinDjView.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4708
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2680
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5336
SearchApp.exe
95.100.146.35:443
www.bing.com
Akamai International B.V.
CZ
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5244
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5244
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 95.100.146.35
  • 95.100.146.32
  • 95.100.146.40
  • 95.100.146.27
  • 95.100.146.34
  • 95.100.146.19
  • 95.100.146.33
  • 95.100.146.17
  • 95.100.146.26
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.73
  • 40.126.31.67
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
th.bing.com
  • 95.100.146.16
  • 95.100.146.40
  • 95.100.146.35
  • 95.100.146.34
  • 95.100.146.8
  • 95.100.146.33
  • 95.100.146.10
  • 95.100.146.17
  • 95.100.146.19
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
windjview.sourceforge.net
  • 104.18.12.149
  • 104.18.13.149
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDjView-2.1-Setup.exe