Malware analysis Everything-1.4.1.1027.x64-Setup.exe Malicious activity

Add for printing

File name:	Everything-1.4.1.1027.x64-Setup.exe
Full analysis:	https://app.any.run/tasks/3e7f4ca1-e8b9-4e63-97a3-00df04d8fa90
Verdict:	Malicious activity
Analysis date:	May 25, 2025, 03:40:42
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	everything tool
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:	78B1AB71ADB67769F6E4E5340DF8C754
SHA1:	5D7D5330AB5B8551D38F55B0B1E2960D78CC0EBE
SHA256:	8CDA27718B0E9D69FC45A66D592A390F2681F1DB9649797A0536DFE5A5253032
SSDEEP:	98304:pJ8PjGGMhEJwmlB2AzRUP6dVlnvCSXal+2VwXbh087CobQ7X8QhLyLvJ0b3DGhVE:pAgAiHx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Changes the autorun value in the registry
  - Everything.exe (PID: 7960)
SUSPICIOUS
- Reads the date of Windows installation
  - everything.exe (PID: 7832)
  - everything.exe (PID: 7912)
- Malware-specific behavior (creating "System.dll" in Temp)
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
- Application launched itself
  - everything.exe (PID: 7832)
- Executable content was dropped or overwritten
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
  - everything.exe (PID: 7912)
- There is functionality for taking screenshot (YARA)
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
- Reads security settings of Internet Explorer
  - everything.exe (PID: 7832)
  - everything.exe (PID: 7912)
  - Everything.exe (PID: 8104)
- The process creates files with name similar to system file names
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
- Creates a software uninstall entry
  - everything.exe (PID: 7912)
- Starts itself from another location
  - everything.exe (PID: 7912)
- Executes as Windows Service
  - Everything.exe (PID: 7988)
INFO
- Creates files in the program directory
  - everything.exe (PID: 7912)
  - Everything.exe (PID: 7960)
- Checks supported languages
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
  - everything.exe (PID: 7832)
  - everything.exe (PID: 7912)
  - Everything.exe (PID: 7960)
  - Everything.exe (PID: 7988)
  - Everything.exe (PID: 8024)
  - Everything.exe (PID: 8104)
- The sample compiled with english language support
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
  - everything.exe (PID: 7912)
- Reads the computer name
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
  - everything.exe (PID: 7912)
  - everything.exe (PID: 7832)
  - Everything.exe (PID: 7960)
  - Everything.exe (PID: 7988)
  - Everything.exe (PID: 8024)
  - Everything.exe (PID: 8104)
- Create files in a temporary directory
  - Everything-1.4.1.1027.x64-Setup.exe (PID: 7284)
- Process checks computer location settings
  - everything.exe (PID: 7832)
  - everything.exe (PID: 7912)
- Creates files or folders in the user directory
  - Everything.exe (PID: 8024)
  - Everything.exe (PID: 8104)
- EVERYTHING mutex has been found
  - Everything.exe (PID: 8104)
- Reads the machine GUID from the registry
  - Everything.exe (PID: 8104)
- Checks proxy server information
  - Everything.exe (PID: 8104)
- Reads the software policy settings
  - Everything.exe (PID: 8104)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2021:09:25 21:56:47+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	26624
InitializedDataSize:	141824
UninitializedDataSize:	2048
EntryPoint:	0x3640
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	1.4.1.1027
ProductVersionNumber:	1.4.1.1027
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
Comments:	-
CompanyName:	-
FileDescription:	Everything Setup
FileVersion:	1.4.1.1027
LegalCopyright:	Copyright (c) 2025 voidtools
LegalTrademarks:	-
ProductName:	Everything
ProductVersion:	1.4.1.1027

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

140

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

7284

"C:\Users\admin\AppData\Local\Temp\Everything-1.4.1.1027.x64-Setup.exe"

C:\Users\admin\AppData\Local\Temp\Everything-1.4.1.1027.x64-Setup.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

Everything Setup

Exit code:

Version:

1.4.1.1027

Modules

Images
c:\users\admin\appdata\local\temp\everything-1.4.1.1027.x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

7336

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

7368

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7832

"C:\Users\admin\AppData\Local\Temp\nspB663.tmp\Everything\Everything.exe" -install "C:\Program Files\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 1"

C:\Users\admin\AppData\Local\Temp\nspB663.tmp\Everything\everything.exe

—

Everything-1.4.1.1027.x64-Setup.exe

User:

admin

Company:

voidtools

Integrity Level:

MEDIUM

Description:

Everything

Exit code:

Version:

1.4.1.1027

Modules

Images
c:\users\admin\appdata\local\temp\nspb663.tmp\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll

7912

"C:\Users\admin\AppData\Local\Temp\nspB663.tmp\Everything\Everything.exe" -isrunas -install "C:\Program Files\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 1"

C:\Users\admin\AppData\Local\Temp\nspB663.tmp\Everything\everything.exe

everything.exe

User:

admin

Company:

voidtools

Integrity Level:

HIGH

Description:

Everything

Exit code:

Version:

1.4.1.1027

Modules

Images
c:\users\admin\appdata\local\temp\nspb663.tmp\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll

7960

"C:\Program Files\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 1

C:\Program Files\Everything\Everything.exe

everything.exe

User:

admin

Company:

voidtools

Integrity Level:

HIGH

Description:

Everything

Exit code:

Version:

1.4.1.1027

Modules

Images
c:\program files\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll

7988

"C:\Program Files\Everything\Everything.exe" -svc

C:\Program Files\Everything\Everything.exe

—

services.exe

User:

SYSTEM

Company:

voidtools

Integrity Level:

SYSTEM

Description:

Everything

Version:

1.4.1.1027

Modules

Images
c:\program files\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll

8024

"C:\Program Files\Everything\Everything.exe" -enable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033

C:\Program Files\Everything\Everything.exe

—

Everything-1.4.1.1027.x64-Setup.exe

User:

admin

Company:

voidtools

Integrity Level:

MEDIUM

Description:

Everything

Exit code:

Version:

1.4.1.1027

Modules

Images
c:\program files\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll

8104

"C:\Program Files\Everything\Everything.exe"

C:\Program Files\Everything\Everything.exe

Everything-1.4.1.1027.x64-Setup.exe

User:

admin

Company:

voidtools

Integrity Level:

MEDIUM

Description:

Everything

Version:

1.4.1.1027

Modules

Images
c:\program files\everything\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll

Add for printing

Total events

2 536

Read events

2 496

Write events

Delete events

Modification events


(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	DisplayName
Value: Everything 1.4.1.1027 (x64)
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	UninstallString
Value: C:\Program Files\Everything\Uninstall.exe
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	NoModify
Value: 1
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	NoRepair
Value: 1
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	Publisher
Value: voidtools
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	EstimatedSize
Value: 3072
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	DisplayIcon
Value: C:\Program Files\Everything\Everything.exe
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	DisplayVersion
Value: 1.4.1.1027
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything
Operation:	write	Name:	InstallLocation
Value: C:\Program Files\Everything
(PID) Process:	(7912) everything.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\voidtools\Everything
Operation:	write	Name:	InstallLocation
Value: C:\Program Files\Everything

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\InstallOptions2.ini		text
		MD5:2D388F85F070760E18EC39C0DF0980DB	SHA256:6003368F4183B166539C96B734C01595A9D1B1494C11F16AEDEFE8AD68E9CFA8
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\ioSpecial.ini		text
		MD5:E2D5070BC28DB1AC745613689FF86067	SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\Everything\everything.exe		executable
		MD5:867ED792FF5F11737DFD0FA74DAE8AF4	SHA256:6AEBCD5C560035129EDF7928C01B02E3E1FE96D4419BFDA5CEC84BB568443EEE
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\Everything\License.txt		text
		MD5:4AD0FF3A90AD4DD6CFFDD413E312EBA3	SHA256:2E1224296BAA039A0A73A76A4693048FA9EDD6A512E21D0F9DE8A24B7360BF9A
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\Everything\Everything.lng		binary
		MD5:F7F8FAE622D1E8CB5569576357B9C492	SHA256:E2788B4A9977D4F63D0EE1ADAFA9359D0AD657D51126D132E3B2418AEC9D5AD9
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\InstallOptions.dll		executable
		MD5:ECE25721125D55AA26CDFE019C871476	SHA256:C7FEF6457989D97FECC0616A69947927DA9D8C493F7905DC8475C748F044F3CF
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\LangDLL.dll		executable
		MD5:68B287F4067BA013E34A1339AFDB1EA8	SHA256:18E8B40BA22C7A1687BD16E8D585380BC2773FFF5002D7D67E9485FCC0C51026
7284	Everything-1.4.1.1027.x64-Setup.exe	C:\Users\admin\AppData\Local\Temp\nspB663.tmp\modern-wizard.bmp		image
		MD5:CBE40FD2B1EC96DAEDC65DA172D90022	SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
7912	everything.exe	C:\Program Files\Everything\Changes.txt		text
		MD5:D3445F1027082AD575C5FDB2074A2813	SHA256:ADD91851B32A8C9FE2A8438CB190D58FE274D67861B1EDF1F43D7028CEDA5E0B
7912	everything.exe	C:\Program Files\Everything\License.txt		text
		MD5:4AD0FF3A90AD4DD6CFFDD413E312EBA3	SHA256:2E1224296BAA039A0A73A76A4693048FA9EDD6A512E21D0F9DE8A24B7360BF9A

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5496	MoUsoCoreWorker.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5496	MoUsoCoreWorker.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4776	SIHClient.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
4776	SIHClient.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
8104	Everything.exe	GET	200	2.16.252.233:80	http://x1.c.lencr.org/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5496	MoUsoCoreWorker.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
—	—	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
—	—	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5496	MoUsoCoreWorker.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3216	svchost.exe	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6544	svchost.exe	20.190.159.128:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6544	svchost.exe	2.17.190.73:80	ocsp.digicert.com	AKAMAI-AS	DE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.124.78.146	whitelisted
google.com	142.250.181.238	whitelisted
crl.microsoft.com	23.216.77.6 23.216.77.28	whitelisted
www.microsoft.com	2.23.181.156 2.23.246.101	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
login.live.com	20.190.159.128 20.190.159.131 20.190.159.75 20.190.159.129 20.190.159.130 40.126.31.1 40.126.31.73 20.190.159.4	whitelisted
ocsp.digicert.com	2.17.190.73	whitelisted
www.voidtools.com	162.211.80.236	whitelisted
x1.c.lencr.org	2.16.252.233	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

Everything-1.4.1.1027.x64-Setup.exe

78B1AB71ADB67769F6E4E5340DF8C754

5D7D5330AB5B8551D38F55B0B1E2960D78CC0EBE

8CDA27718B0E9D69FC45A66D592A390F2681F1DB9649797A0536DFE5A5253032

98304:pJ8PjGGMhEJwmlB2AzRUP6dVlnvCSXal+2VwXbh087CobQ7X8QhLyLvJ0b3DGhVE:pAgAiHx

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

SUSPICIOUS

Reads the date of Windows installation

Malware-specific behavior (creating "System.dll" in Temp)

Application launched itself

Executable content was dropped or overwritten

There is functionality for taking screenshot (YARA)

Reads security settings of Internet Explorer

The process creates files with name similar to system file names

Creates a software uninstall entry

Starts itself from another location

Executes as Windows Service

INFO

Creates files in the program directory

Checks supported languages

The sample compiled with english language support

Reads the computer name

Create files in a temporary directory

Process checks computer location settings

Creates files or folders in the user directory

EVERYTHING mutex has been found

Reads the machine GUID from the registry

Checks proxy server information

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings