Windows Analysis Report
Everything-1.4.1.1026.x86-Setup.exe

Overview

General Information

Sample name: Everything-1.4.1.1026.x86-Setup.exe
Analysis ID: 1543807
MD5: f81112d40609b97330688098222ef1fb
SHA1: 092f5b3f4f7b437923e4cbaf2dd12a6d793a32b0
SHA256: bbf249ab7d4ea4b17a56d2effcd0df563bf4d5cd4f6e00ebf5e74a74ca0034e2
Infos:

Detection

Score: 20
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Compliance

Score: 48
Range: 0 - 100

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)
Checks for available system drives (often done to infect USB drives)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Compliance
barindex
Uses 32bit PE files
Source: Everything-1.4.1.1026.x86-Setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\License.txt
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe File created: C:\Program Files (x86)\Everything\License.txt
Source: Everything-1.4.1.1026.x86-Setup.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 162.211.80.236:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: Everything-1.4.1.1026.x86-Setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Checks for available system drives (often done to infect USB drives)
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: z:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: x:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: v:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: t:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: r:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: p:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: n:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: l:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: j:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: h:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: f:
Source: C:\Windows\System32\svchost.exe File opened: d:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: b:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: y:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: w:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: u:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: s:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: q:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: o:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: m:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: k:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: i:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: g:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: e:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: c:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: a:
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: www.voidtools.com
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown HTTPS traffic detected: 162.211.80.236:443 -> 192.168.2.16:49705 version: TLS 1.2
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Uses 32bit PE files
Source: Everything-1.4.1.1026.x86-Setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: sus20.evad.winEXE@16/26@1/9
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe File created: C:\Program Files (x86)\Everything
Source: C:\Program Files (x86)\Everything\Everything.exe File created: C:\Users\Public\Desktop\Everything.lnk
Source: C:\Program Files (x86)\Everything\Everything.exe Mutant created: \Sessions\1\BaseNamedObjects\EVERYTHING_MUTEX
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File created: C:\Users\user\AppData\Local\Temp\nsu8BE6.tmp
Source: Everything-1.4.1.1026.x86-Setup.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File read: C:\Users\desktop.ini
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File read: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe
Source: unknown Process created: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe "C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe"
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe "C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe" -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3"
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3
Source: unknown Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe" -svc
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe" -enable-update-notification -install-quick-launch-shortcut -no-choose-volumes -language 1036
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe "C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe" -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3"
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe" -enable-update-notification -install-quick-launch-shortcut -no-choose-volumes -language 1036
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe"
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: propsys.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: oleacc.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: riched20.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: usp10.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Section loaded: msls31.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: linkinfo.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: ntshrui.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: cscapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: linkinfo.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: ntshrui.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: cscapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: schannel.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: dpapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Everything\Everything.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File written: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\InstallOptions.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Everything-1.4.1.1026.x86-Setup.exe Static PE information: certificate valid
Source: Everything-1.4.1.1026.x86-Setup.exe Static file information: File size 1816888 > 1048576
Source: Everything-1.4.1.1026.x86-Setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Drops PE files
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe File created: C:\Program Files (x86)\Everything\Uninstall.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe File created: C:\Program Files (x86)\Everything\Everything.exe Jump to dropped file
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\License.txt
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe File created: C:\Program Files (x86)\Everything\License.txt
Stores files to the Windows start menu directory
Source: C:\Program Files (x86)\Everything\Everything.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything.lnk
Source: C:\Program Files (x86)\Everything\Everything.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Everything
Source: C:\Program Files (x86)\Everything\Everything.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Everything
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Everything\Everything.exe Process information set: NOOPENFILEERRORBOX
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\svchost.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Dropped PE file which has not been started: C:\Program Files (x86)\Everything\Uninstall.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 6768 Thread sleep time: -30000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File Volume queried: C:\Program Files (x86) FullSizeInformation
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe File Volume queried: C:\Program Files (x86) FullSizeInformation
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Program Files (x86)\Everything\Everything.exe File opened: C:\Users\user\AppData
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe "c:\users\user\appdata\local\temp\nsp8c17.tmp\everything\everything.exe" -install "c:\program files (x86)\everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3"
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "c:\program files (x86)\everything\everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3
Source: C:\Users\user\Desktop\Everything-1.4.1.1026.x86-Setup.exe Process created: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe "c:\users\user\appdata\local\temp\nsp8c17.tmp\everything\everything.exe" -install "c:\program files (x86)\everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3"
Source: C:\Users\user\AppData\Local\Temp\nsp8C17.tmp\Everything\Everything.exe Process created: C:\Program Files (x86)\Everything\Everything.exe "c:\program files (x86)\everything\everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -install-url-protocol -install-efu-association -install-language 1036 -save-install-options 3
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C: VolumeInformation
Source: C:\Program Files (x86)\Everything\Everything.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Everything\Everything.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Everything\Everything.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Everything\Everything.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Everything\Everything.exe Queries volume information: C:\ VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.211.80.236
 voidtools.com United States
63410 PRIVATESYSTEMSUS false
184.28.90.27
 unknown United States
16625 AKAMAI-ASUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
voidtools.com 162.211.80.236 true
www.voidtools.com unknown unknown