Everything-1[.]4[.]1[.]1032[.]x64-Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Everything-1.4.1.1032.x64-Setup.exe
Size 1.9MB
Sample260727-rdknvst1cs
SHA256 c42efad041d4c0bb4d4ac97ae7cbe89f153ec1fe078772392e749c7f5d5282d3
MD5 3fb552bbea367207655a6868622a6da9
SHA1 a454fa6f044b8dd3a338652fe53cea28500a0c04
SHA512 1e914dc40a12368d5e272ee78b092ef4f0786408af40b1eba78ffaef243220affdde000799853e5a056a33b6dade647339a15ddac859ce72c001e817c29337c1
SSDEEP 49152:z4ijEfHi9iisLxe0ciIxoFujij8vZ6HE9+0z5kmU:z49vi97sle/aFGuNkU0z5bU
TLSH
T116952364A380D26BD1061974C8E9A36262D6FD36551142EF73A0BF7EBD787C3BE42312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

File Explorer

Everything-1.4.1.1032.x64-Setup.exe

.exe 1.9MB
$PLUGINSDIR/Everything/License.txt

2KB
$PLUGINSDIR/Everything/everything.exe

.exe 2.2MB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB
$PLUGINSDIR/InstallOptions.ini

754B
$PLUGINSDIR/InstallOptions2.ini

1017B
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-wizard.bmp

25KB

Everything-1.4.1.1032.x64-Setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 c42efad041d4c0bb4d4ac97ae7cbe89f153ec1fe078772392e749c7f5d5282d3
MD5 3fb552bbea367207655a6868622a6da9
SHA1 a454fa6f044b8dd3a338652fe53cea28500a0c04
SHA512 1e914dc40a12368d5e272ee78b092ef4f0786408af40b1eba78ffaef243220affdde000799853e5a056a33b6dade647339a15ddac859ce72c001e817c29337c1
SSDEEP 49152:z4ijEfHi9iisLxe0ciIxoFujij8vZ6HE9+0z5kmU:z49vi97sle/aFGuNkU0z5bU
TLSH
T116952364A380D26BD1061974C8E9A36262D6FD36551142EF73A0BF7EBD787C3BE42312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

bf:54:c7:11:aa:e5:73:3f:8d:23:cc:16:a0:06:87:55:58:9e:29:12:46:a3:ce:e8:e5:69:8d:31:4a:ee:5b:2b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Jan 23, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/Everything/everything.exe

IMPHASH 66c76b088c44e7dc1b88a25f82913490
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

10:65:82:b1:61:15:cd:98:9a:19:90:57:8d:7a:db:b4:8f:89:af:24:6a:d9:fd:18:a0:ec:ff:8e:97:29:cd:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Jan 23, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1749728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\dev\Everything-1.4\x64\Release\Everything.pdb

comctl32

ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent InitCommonControlsEx

ws2_32

WSAGetLastError WSACleanup closesocket send recv connect WSAAsyncSelect setsockopt socket WSAStartup shutdown listen bind getpeername ntohs getsockname accept inet_addr gethostbyname htons

shlwapi

SHRegGetUSValueW PathIsRootW PathCombineW PathRemoveFileSpecW

kernel32

FileTimeToSystemTime GetSystemTime FreeResource LockResource LoadResource SizeofResource FindResourceW GetSystemDefaultLangID CopyFileW TerminateProcess OpenProcess CreateMutexW SetLastError GetStartupInfoW HeapAlloc GetProcessHeap HeapFree VirtualAlloc VirtualFree QueryDosDeviceW SetErrorMode DeleteFileW RemoveDirectoryW MoveFileW MoveFileExW CreateDirectoryW GetFileAttributesW GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetComputerNameW GetVolumeInformationW GetDiskFreeSpaceW GetFullPathNameW GetFileSize FindFirstFileW FindNextFileW GetDriveTypeW GetThreadPriority CreateEventW GetProcAddress FreeLibrary LoadLibraryExW SetFilePointer GetWindowsDirectoryW GetCurrentDirectoryW GetFileAttributesExW LocalFileTimeToFileTime SystemTimeToFileTime FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime __C_specific_handler WaitForMultipleObjects GetSystemDirectoryW ExpandEnvironmentStringsW GetSystemInfo GetVersionExA LocalFree LocalAlloc ConnectNamedPipe CreateNamedPipeW GetTimeZoneInformation MulDiv LoadLibraryA GetTimeFormatW GetNumberFormatW GetDateFormatW MultiByteToWideChar HeapCreate HeapSetInformation GetModuleFileNameA FlsAlloc TlsSetValue FlsFree TlsFree FlsSetValue FlsGetValue GetModuleHandleA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetStartupInfoA GetCommandLineA CreateThread ExitThread GetTempPathW CreateFileW FreeConsole AllocConsole SetStdHandle SetConsoleScreenBufferSize ExitProcess QueryPerformanceFrequency QueryPerformanceCounter WriteFile FlushFileBuffers GetStdHandle GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW GetLocaleInfoW GetCalendarInfoW DeviceIoControl GetOverlappedResult ResetEvent Sleep FindNextChangeNotification FindFirstChangeNotificationW GetFileInformationByHandle GetLocalTime FindCloseChangeNotification FindClose GetSystemTimeAsFileTime GetCurrentThread SetThreadPriority InitializeCriticalSection WaitForSingleObject DeleteCriticalSection EnterCriticalSection GetTickCount LeaveCriticalSection SetEvent GetCommandLineW GetCurrentThreadId GetModuleHandleW ReadFile GetLastError CloseHandle WideCharToMultiByte GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetCurrentProcessId HeapReAlloc LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize GetModuleFileNameW

user32

IsWindowVisible SetCursor SetCapture ChangeClipboardChain DrawEdge DrawFrameControl EqualRect GetSubMenu GetMenu SetClipboardViewer EnumWindows ActivateKeyboardLayout LoadIconW IsDlgButtonChecked SetScrollInfo UpdateWindow ScrollWindowEx SetDlgItemInt GetMenuState RemoveMenu GetMenuItemID GetMenuDefaultItem EnableMenuItem AdjustWindowRect GetSysColorBrush OffsetRect InvalidateRgn MessageBeep SetCursorPos GetDlgItemInt GetDlgCtrlID SendDlgItemMessageW GetDesktopWindow ValidateRect CharLowerW CharUpperW CreateIconIndirect PostQuitMessage GetLastActivePopup IsClipboardFormatAvailable GetForegroundWindow AttachThreadInput SetActiveWindow BringWindowToTop EnumChildWindows CheckDlgButton GetMenuItemInfoW GetKeyboardLayoutList LoadCursorW CreateDialogIndirectParamW InvalidateRect ClientToScreen ScreenToClient ShowWindow IsIconic GetWindowPlacement IsZoomed GetWindowTextLengthW GetWindowTextW GetParent CopyRect EmptyClipboard SetClipboardData GetWindowLongPtrW SetWindowLongPtrW SetFocus PtInRect FindWindowW InsertMenuW SetDlgItemTextW SetForegroundWindow BeginPaint EndPaint OpenClipboard GetClipboardData CloseClipboard FillRect CreateWindowExW GetClassInfoExW RegisterClassExW IsWindowEnabled GetAsyncKeyState GetClientRect GetCapture OpenIcon ReleaseCapture GetFocus GetNextDlgTabItem EnableWindow SetWindowPos SetWindowTextW SetWindowLongW MessageBoxW DialogBoxIndirectParamW DrawTextW GetMenuItemCount CreatePopupMenu AppendMenuW DeleteMenu SetMenuItemInfoW GetWindowLongW AdjustWindowRectEx CallWindowProcW GetDlgItem GetWindowRect MapWindowPoints IntersectRect GetMonitorInfoW SystemParametersInfoW GetDC ReleaseDC SetWindowsHookExW PeekMessageW WaitMessage SetMenu RegisterClipboardFormatW RedrawWindow GetMessagePos RegisterWindowMessageA ReplyMessage GetCursorPos CreateMenu SetMenuDefaultItem TrackPopupMenu DestroyMenu KillTimer GetDoubleClickTime RegisterHotKey GetKeyState UnregisterHotKey PostThreadMessageW GetSysColor EndDialog PostMessageW DestroyIcon SetTimer DestroyWindow DefWindowProcW SendMessageTimeoutW GetWindowThreadProcessId IsWindow GetKeyNameTextW MapVirtualKeyExW GetKeyboardLayout LoadImageW UnhookWindowsHookEx CallNextHookEx GetClassNameW SendMessageW GetMessageW TranslateMessage DispatchMessageW GetSystemMetrics GetScrollInfo

gdi32

SetStretchBltMode GetDeviceCaps GetDIBits SelectClipRgn TextOutW GetTextAlign SetTextAlign CreateCompatibleBitmap OffsetClipRgn OffsetRgn CombineRgn GetDCOrgEx GetRandomRgn EnumFontFamiliesExW CreateCompatibleDC BitBlt StretchDIBits GetRegionData ExtCreateRegion GetObjectW CreateFontIndirectW GetStockObject GetNearestColor CreateSolidBrush CreateRectRgn CreateDIBSection GetCurrentObject ExcludeClipRect RectVisible GetTextExtentExPointW GetTextExtentPoint32W DeleteDC SetBkMode CreateBitmapIndirect CreatePatternBrush SetBrushOrgEx SetBkColor SetTextColor PatBlt SelectObject GetTextMetricsW StretchBlt DeleteObject

comdlg32

GetOpenFileNameW GetSaveFileNameW ChooseColorW CommDlgExtendedError

advapi32

RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW DeleteService CloseServiceHandle RegOpenKeyA RegQueryValueW InitializeSecurityDescriptor SetSecurityDescriptorDacl QueryServiceConfigW RegDeleteValueW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegEnumKeyW RegCloseKey RegDeleteKeyW GetUserNameW RegisterEventSourceW ReportEventW DeregisterEventSource CreateServiceW StartServiceW OpenSCManagerW OpenServiceW ControlService SetServiceStatus

shell32

DragFinish DragAcceptFiles Shell_NotifyIconW SHBrowseForFolderW SHGetFileInfoW DragQueryFileW SHGetSpecialFolderLocation ord16 SHFileOperationW ShellExecuteExW SHGetDesktopFolder SHGetPathFromIDListW SHChangeNotify DragQueryPoint

ole32

CoTaskMemFree OleUninitialize OleInitialize CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop DoDragDrop RegisterDragDrop ReleaseStgMedium CreateBindCtx

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
TLSH
T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

Everything-1.4.1.1032.x64-Setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/Everything/License.txt

$PLUGINSDIR/Everything/everything.exe

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/InstallOptions.ini

$PLUGINSDIR/InstallOptions2.ini

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp