21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T410,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 19a2f7bd08cb… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 19a2f7bd08cb…. Threat score 0/100. 0/27 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf","keywords":["Clean","malware analysis","sandbox report","threat intelligence","19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf"],"about":{"@type":"SoftwareApplication","name":"rufus-3.15.exe","applicationCategory":["peexe","executable"],"identifier":"19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T42a,"rufus-3.15.exe" called "FindResourceA" with parameter "500" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "101" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "103" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "106" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "125" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "126" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "401" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "403" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "121" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "122" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "123" - (UID: 00000000-00007636) "rufus-3.15.exe" called "FindResourceA" with parameter "124" - (UID: 00000000-00007636)23:T5f7,"rufus-3.15.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14003552'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14000568'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14000648'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14000768'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14001592'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14001632'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14003272'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14003352'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14001432'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14001472'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14001512'}" (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '14001552'}" (UID: 00000000-00007636)24:T716,"rufus-3.15.exe" called "GetWindowTextW" with parameter "More information" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Do you want to allow Rufus to check for application updates online?" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "4e006f00" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Yes" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "START" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "CLOSE" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "SELECT" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Use Rufus MBR with BIOS ID" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Check device for bad blocks" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "List USB Hard Drives" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Add fixes for old BIOSes (extra partition, align, etc.)" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Quick format" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Create extended label and icon files" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextA" with parameter "Rufus 3.15.1812" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Drive Properties" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Format Options" - (UID: 00000000-00007636) "rufus-3.15.exe" called "GetWindowTextW" with parameter "Status" - (UID: 00000000-00007636)25:T1154,"rufus-3.15.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007636) "rufus-3.15.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007636) "rufus-3.15.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000e603927e7b760000a90100000000607ca901fefab6bdb06b3073ec1d307358e5e603b06b30730000a90118000000000000008000000098e4e603010000001ce5e60370e17c76b06b3073009d317302000000ae807c76607ca901ece4e60375877d761c9382762ce5e6033d7c7d760800000095807c767b807c7606fbb6bdb06b3073ec1d307302000000b06b3073009d31730200000064e5e60370e17c7630e5e60375877d761c93827674e5e60399653173080000007d65317392f83d22b06b3073ec1d307302000000009d3173a87ca901607ca90140e5e603968b307314e6e603306b31736ecde952feffffff80e5e603ae653173009d317398e5e603 (UID: 00000000-00007636) "rufus-3.15.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007636) "rufus-3.15.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000656d00010000e8c04401bce71f01201bb17600000000205544015017f073eb1dac7600000000e8e71f016017f0733c55440196f1ef73ef7912b7c0f843012055440100000000130000003017f0735017f0732055440100000000000000006ce81f016ce81f016017f0733c55440177ceef7318554401c0f8430187ceef73000000000000000018554401000000003017f07398000000c0f843014ce81f01201bb176ffffffff5ce81f01101eac769ca09a6afb3e656d48e81f0168107d773c55440120000000b0ac4001185544010ec0cf760a6c5e9700000000c0f84301cdac40011000000000b7ef7350e81f0170cdef738ce91f01b0bad676ea9aa7e0 (UID: 00000000-00007636) "rufus-3.15.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000f4d61f016820ac7603000000000000005300656d109af1720000000034d71f01201bb176ffffffff44d71f015810ac763c10ac76e301656d109af172d445f172d845f17224d71f0120d71f010d0000000d0000009003f372dc54f572000000006cacf272d858f572b8d71f01608daf76efc3c21afeffffff50d71f01900fac769003f37260d71f0184d4f272dc54f5729003f3726cd71f01a4d4f2729003f37288d71f011a9af1729003f372528bab76010000000100000017d4f272c8d71f0186caf272000000004acaf2721f094ea8010000000100000000000000000000000000000098d71f013dba19f408d81f01f0ccf2726ff2a4dbfeffffff (UID: 00000000-00007636) "rufus-3.15.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000001e08927e7b760000a90100000000f88158036ef84eb6b06b8972ec1d8972c8e61e08b06b89720000a90118000000000000008000000008e61e08010000008ce61e0870e17c76b06b8972009d8a7202000000ae807c76f88158035ce61e0875877d761c9382769ce61e083d7c7d760800000095807c767b807c76b6f84eb6b06b8972ec1d897202000000b06b8972009d8a7202000000d4e61e0870e17c76a0e61e0875877d761c938276e4e61e0899658a72080000007d658a728f90f2ecb06b8972ec1d897202000000009d8a7240825803f8815803b0e61e08968b897284e71e08306b8a72e3a66796fefffffff0e61e08ae658a72009d8a7208e71e08 (UID: 00000000-00007636)26:T8c4,"rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")27:T56f,"rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "rufus-3.15.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")28:T78b,"rufus-3.15.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter COMCTL32.DLL (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter COMDLG32.DLL (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter Riched20 (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter WinInet (UID: 00000000-00007636) "rufus-3.15.exe" called "LoadLibrary" with a parameter %WINDIR%\Sysnative\en-US\shell32.dll.mui (UID: 00000000-00007636)29:Tcaf5,"rufus-3.15.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter AttachConsole (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DefineDosDeviceA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DeleteVolumeMountPointA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter EnumUILanguagesW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FindFirstVolumeA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FindNextVolumeA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FindVolumeClose (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSystemDefaultLangID (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetVolumeNameForVolumeMountPointA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetVolumePathNameA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter K32GetModuleFileNameExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter K32GetProcessImageFileNameW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter QueryDosDeviceA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetDllDirectoryA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetThreadAffinityMask (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetVolumeLabelA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetVolumeMountPointA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter VerifyVersionInfoA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptVerifySignatureW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RegDeleteKeyA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorOwner (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ImageList_ReplaceIcon (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CommDlgExtendedError (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetOpenFileNameW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSaveFileNameW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CertGetNameStringA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptDecodeObjectEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptMsgOpenToDecode (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptMsgUpdate (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreatePen (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter EnumFontFamiliesExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetTextFaceW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LineTo (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MoveToEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter Rectangle (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetDCPenColor (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __getmainargs (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __initenv (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __p___argv (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __p__acmdln (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __p__commode (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __set_app_type (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _access (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _assert (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _atoi64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _chdir (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _close (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _filelengthi64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _fileno (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _flushall (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _fstati64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _iob (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _lseeki64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _mkdir (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _open_osfhandle (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _open (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _read (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _setjmp3 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _snprintf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _snprintf_s (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _snwprintf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _splitpath (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _stati64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _strcmpi (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _strnicmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _strtoi64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _tzset (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _vscprintf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _vsnprintf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _waccess (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wchdir (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wcsnicmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wfopen_s (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wmkdir (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _write (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wsopen_s (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wstat64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wstati64 (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter _wunlink (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter atoi (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter atol (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter clearerr (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter feof (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ferror (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fflush (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fgetpos (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fgets (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fgetws (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fputs (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fputws (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter freopen (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fseek (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fsetpos (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ftell (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fwprintf_s (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter getc (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter gmtime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter getenv (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter isalpha (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter islower (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter isspace (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter isupper (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter localtime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter longjmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter mktime (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter printf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter putchar (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter puts (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter qsort (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter setlocale (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter rename (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter setvbuf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strcat (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strncat (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strspn (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strtok (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strtol (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter strtoul (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter time (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter toupper (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcscpy (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcsncat (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcsncmp (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcsncpy (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcsspn (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcsstr (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wcstombs (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Get_Child (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Get_DevNode_Status (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Get_Device_IDA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Get_Device_ID_ListA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Get_Device_ID_List_SizeA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Get_Parent (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Get_Sibling (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CM_Locate_DevNodeA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiChangeState (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInfo (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInstanceIdA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetupDiSetClassInstallParamsW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DragQueryFileW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHBrowseForFolderW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHChangeNotifyDeregister (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHChangeNotifyRegister (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHCreateDirectoryExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHFileOperationW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SHSimpleIDListFromPath (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter PathFileExistsA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter PathFileExistsW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter PathGetDriveNumberW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter wnsprintfW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CharUpperBuffW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CheckDlgButton (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CopyRect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateDialogIndirectParamW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateIconIndirect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreatePopupMenu (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DestroyMenu (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DialogBoxIndirectParamW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DrawIconEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DrawTextExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FindWindowExA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter FlashWindowEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetDlgItemTextW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InflateRect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InsertMenuW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter IsDlgButtonChecked (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MapDialogRect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MessageBeep (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MessageBoxExW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter PostQuitMessage (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SendDlgItemMessageA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetDlgItemTextA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetDlgItemTextW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetProcessDefaultLayout (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter TrackPopupMenuEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter UnhookWinEvent (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter WinVerifyTrustEx (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter __wgetmainargs (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter NtOpenProcessToken (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter NtAdjustPrivilegesToken (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00007636) "rufus-3.15.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00007636)2a:T7a0,Found reference to API (Indicator: "FreeSid"; File: "rufus-3.15.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "rufus-3.15.exe") Found reference to API (Indicator: "CryptMsgClose"; File: "rufus-3.15.exe") Found reference to API (Indicator: "VirtualProtect"; File: "rufus-3.15.exe") Found reference to API (Indicator: "GetProcAddress"; File: "rufus-3.15.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "rufus-3.15.exe") Found reference to API (Indicator: "ExitProcess"; File: "rufus-3.15.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "rufus-3.15.exe") Found reference to API (Indicator: "GetDC"; File: "rufus-3.15.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "rufus-3.15.exe") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "CryptMsgClose"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007636.00000000.140464.00D5A000.00000004.mdmp")2b:T1034,"rufus-3.15.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774e0000 "rufus-3.15.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774e0000 "rufus-3.15.exe" loaded module "KERNEL32" at base 756a0000 "rufus-3.15.exe" loaded module "KERNEL32.DLL" at base 756a0000 "rufus-3.15.exe" loaded module "ADVAPI32.DLL" at base 76900000 "rufus-3.15.exe" loaded module "COMCTL32.DLL" at base 751f0000 "rufus-3.15.exe" loaded module "COMDLG32.DLL" at base 77020000 "rufus-3.15.exe" loaded module "CRYPT32.DLL" at base 76980000 "rufus-3.15.exe" loaded module "GDI32.DLL" at base 76030000 "rufus-3.15.exe" loaded module "MSVCRT.DLL" at base 76770000 "rufus-3.15.exe" loaded module "OLE32.DLL" at base 771e0000 "rufus-3.15.exe" loaded module "SETUPAPI.DLL" at base 76330000 "rufus-3.15.exe" loaded module "SHELL32.DLL" at base 75850000 "rufus-3.15.exe" loaded module "SHLWAPI.DLL" at base 76060000 "rufus-3.15.exe" loaded module "USER32.DLL" at base 77330000 "rufus-3.15.exe" loaded module "WINTRUST.DLL" at base 770d0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 756a0000 "rufus-3.15.exe" loaded module "RPCRT4.DLL" at base 76840000 "rufus-3.15.exe" loaded module "SSPICLI.DLL" at base 74160000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76980000 "rufus-3.15.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 756a0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73cb0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 760b0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c70000 "rufus-3.15.exe" loaded module "RICHED20" at base 73460000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 733d0000 "rufus-3.15.exe" loaded module "COMCTL32" at base 751f0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75f50000 "rufus-3.15.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 762a0000 "rufus-3.15.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77330000 "rufus-3.15.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77330000 "rufus-3.15.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76900000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 771e0000 "rufus-3.15.exe" loaded module "WININET" at base 74d40000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 73c20000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSWOW64\OLEACC.DLL" at base 72f10000 "rufus-3.15.exe" loaded module "OLEAUT32.DLL" at base 77140000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72d30000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 72cd0000 "rufus-3.15.exe" loaded module "DEVOBJ.DLL" at base 74740000 "rufus-3.15.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 774e0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 73c10000 "rufus-3.15.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72cb0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72cb0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74000000 "rufus-3.15.exe" loaded module "WINHTTP.DLL" at base 72bd0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72bb0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72b50000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72ac0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72a40000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 729d0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 729d0000 "rufus-3.15.exe" loaded module "CRYPTNET.DLL" at base 729d0000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSNATIVE\EN-US\SHELL32.DLL.MUI" at base 8250000 "rufus-3.15.exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 729400002c:T9ac,The input sample is signed with a certificate issued by "CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: E4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: E8:49:90:CB:9B:F8:E3:AB:0B:CA:E8:A6:49:CB:30:FE:4D:C4:D7:67; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: CA:77:88:C3:2D:A1:E4:B7:86:3A:4F:B5:7D:00:B5:5D:DA:CB:C7:F9; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information) The input sample is signed with a certificate issued by "CN=R11, O=Let's Encrypt, C=US" (SHA1: 1F:11:BA:5A:BF:68:3F:C9:4D:7C:F8:C2:07:DD:3D:A4:AD:A8:14:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 69:6D:B3:AF:0D:FF:C1:7E:65:C6:A2:0D:92:5C:5A:7B:D2:4D:EC:7E; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 9C:E9:A7:1C:CA:B3:B3:8A:74:78:1B:97:5F:1C:22:82:22:CF:7D:3B; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)2d:T751,"rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\TREATAS"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\TREATAS"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCSERVER32"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCSERVER32"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCHANDLER32"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCHANDLER32"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCHANDLER"; Key: ""; Value: "")2e:T8a2,"rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCSERVER32"; Key: ""; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}"; Key: "APPID"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "")2f:T4e0,"rufus-3.15.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\cfgmgr32.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\msasn1.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll" "rufus-3.15.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "rufus-3.15.exe" trying to touch file "\Global??\FltMgrMsg" "rufus-3.15.exe" trying to touch file "C:\WINDOWS\SYSTEM32\SspiCli.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\sspicli.dll" "rufus-3.15.exe" trying to touch file "C:\WINDOWS\SYSTEM32\windows.storage.dll" "rufus-3.15.exe" trying to touch file "C:\Windows\SysWOW64\windows.storage.dll"30:T49d,"rufus-3.15.exe" touched file "C:\Windows\SysWOW64\GroupPolicy\gpt.ini" "rufus-3.15.exe" touched file "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" "rufus-3.15.exe" touched file "C:\Windows\System32\GroupPolicy\gpt.ini" "rufus-3.15.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "rufus-3.15.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "rufus-3.15.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "rufus-3.15.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido[1].ver" "rufus-3.15.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido.ps1[1].lzma" "rufus-3.15.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "rufus-3.15.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "rufus-3.15.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "rufus-3.15.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido[1].ver" "rufus-3.15.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido.ps1[1].lzma"31:T46d,"rufus-3.15.exe" trying to access non-existent file "C:\rufus.app" "rufus-3.15.exe" trying to access non-existent file "C:\rufus.ini" "rufus-3.15.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui" "rufus-3.15.exe" trying to access non-existent file "C:\rufus.loc" "rufus-3.15.exe" trying to access non-existent file "C:\rufus-3.15.exe.Local\" "rufus-3.15.exe" trying to access non-existent file "C:\Windows\System32\GroupPolicy\User\Registry.pol" "rufus-3.15.exe" trying to access non-existent file "C:\Windows\SysWOW64\uxtheme.dll.Config" "rufus-3.15.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "rufus-3.15.exe" trying to access non-existent file "\Device\RasAcd" "rufus-3.15.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "rufus-3.15.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui" "rufus-3.15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG" "rufus-3.15.exe" trying to access non-existent file "C:\rufus.com"32:T429,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007636.00000000.140464.013E0000.00000004.mdmp, 00000000-00007636.00000000.140464.01A90000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007636.00000000.140464.013E0000.00000004.mdmp, 00000000-00007636.00000000.140464.01A90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007636.00000000.140464.013E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007636.00000000.140464.013E0000.00000004.mdmp") Found string "vverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007636.00000000.140464.01A90000.00000004.mdmp") Found string "vverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007636.00000000.140464.01A90000.00000004.mdmp")33:T908,"rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "RECVBUFFERSIZE"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "DISABLETLS1.3"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "")34:T659,"rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000"; Key: "SERVICE") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000"; Key: "UPPERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000"; Key: "LOWERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "SERVICE") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "UPPERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "LOWERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "SERVICE") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "UPPERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "LOWERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "HARDWAREID") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "FRIENDLYNAME") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000"; Key: "HARDWAREID")35:T77c,"rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000"; Key: "SERVICE") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000\FILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000"; Key: "UPPERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&290FCA62&0&000000"; Key: "LOWERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "SERVICE") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000\FILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "UPPERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "LOWERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "SERVICE") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1\FILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "UPPERFILTERS") "rufus-3.15.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "LOWERFILTERS")36:T5d6,"rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "SUBMITSAMPLESCONSENT"; Value: "02000000") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "DISABLEBLOCKATFIRSTSEEN"; Value: "01000000") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{37727635-E858-4E69-AB08-4B894D3E43A5}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{37727635-E858-4E69-AB08-4B894D3E43A5}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "SUBMITSAMPLESCONSENT"; Value: "02000000") "rufus-3.15.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{37727635-E858-4E69-AB08-4B894D3E43A5}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "DISABLEBLOCKATFIRSTSEEN"; Value: "01000000")37:T406,"rufus-3.15.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "ENABLESMARTSCREEN"; Value: "00000000") "rufus-3.15.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "**DEL.SHELLSMARTSCREENLEVEL"; Value: "20000000") "rufus-3.15.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{37727635-E858-4E69-AB08-4B894D3E43A5}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "ENABLESMARTSCREEN"; Value: "00000000") "rufus-3.15.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{37727635-E858-4E69-AB08-4B894D3E43A5}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "**DEL.SHELLSMARTSCREENLEVEL"; Value: "20000000")38:T1d19,"rufus-3.15p.exe" called "NtOpenSection" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtCreateSection" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryInformationToken" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenKeyEx" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryValueKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtSetInformationKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryInformationFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtEnumerateKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtProtectVirtualMemory" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenThread" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtResumeThread" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryAttributesFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryVolumeInformationFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtAllocateVirtualMemory" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtMapViewOfSection" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtSetInformationProcess" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "LdrGetDllHandle" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "LdrLoadDll" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "LoadLibrary" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryVirtualMemory" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "GetProcAddress" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryInformationProcess" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtCreateMutant" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenEvent" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQuerySystemInformation" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtCreateEvent" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenDirectoryObject" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenThreadToken" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenProcessToken" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "RpcStringBindingComposeW" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtAlpcConnectPortEx" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtAlpcSendWaitReceivePort" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtCreateFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtEnumerateValueKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtCreateThreadEx" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtDeviceIoControlFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtSetValueKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtReadFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtWriteFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "GetVersionExA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtConnectPort" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtRequestWaitReplyPort" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtSuspendThread" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtGetContextThread" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtAdjustPrivilegesToken" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtWaitForMultipleObjects" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtNotifyChangeKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtSetInformationFile" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtCreateKeyEx" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtAlpcConnectPort" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtSetInformationThread" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtDeleteKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "LdrUnloadDll" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenMutant" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryObject" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueryLicenseValue" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "RpcServerUseProtseqEpW" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQuerySystemTime" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "SetupDiGetClassDevsA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "SetupDiEnumDeviceInfo" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtOpenProcess" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "InternetSetOption" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "InternetConnectA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtQueueApcThread" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtDelayExecution" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "SetupDiGetDeviceRegistryPropertyA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "BCryptImportKeyPair" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "BCryptImportKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "BCryptEncrypt" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "BCryptDecrypt" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtTerminateThread" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtDeleteValueKey" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "NtTerminateProcess" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "GetUserNameA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "RtlGetNtProductType" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "IsWow64Process" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "RtlGetVersion" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "FindResourceA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "CreateToolhelp32Snapshot" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "LoadResource" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "CreateCompatibleBitmap" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "GetWindowTextW" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "GetKeyState" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "GetWindowTextA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "FindWindowExW" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "InternetOpenA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "HttpOpenRequestA" (PID: 1760) (UID: 00000000-00001760) "rufus-3.15p.exe" called "GetForegroundWindow" (PID: 1760) (UID: 00000000-00001760)39:Ta1e,"\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001760.00000000.78742.03110000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "[SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "][SOFTWARE\Policies\Microsoft\AppHVSI" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "][SOFTWARE\Policies\Microsoft\Windows\System" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "][SOFTWARE\Policies\Microsoft\Windows\Windows Search" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "][SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "][SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "][SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00001760.00000000.78742.03250000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001760.00000000.78742.7E890000.00000002.mdmp3a:T2331,"rufus-3.15p.exe" loaded module "C:\rufus-3.15p.exe" at 00820000 "rufus-3.15p.exe" loaded module "%WINDIR%\System32\ntdll.dll" at FCD00000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77D80000 "rufus-3.15p.exe" loaded module "%WINDIR%\System32\wow64.dll" at 77C40000 "rufus-3.15p.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 77CA0000 "rufus-3.15p.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 03050000 "rufus-3.15p.exe" loaded module "%WINDIR%\System32\user32.dll" at 03120000 "rufus-3.15p.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 77C30000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 74BC0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 77940000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 77BB0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 74B00000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 74FC0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75A50000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 746B0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 746A0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 746D0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\comdlg32.dll" at 758F0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 748B0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 764E0000 "rufus-3.15p.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" at 73560000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 762B0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 76380000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 751F0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 03750000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 77B20000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 74730000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 74E00000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 74F30000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 76600000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 77D30000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 75C10000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 74F20000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 75010000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 754A0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\crypt32.dll" at 75060000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\msasn1.dll" at 77D70000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 75B10000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\setupapi.dll" at 754C0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\wintrust.dll" at 75300000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74F80000 "rufus-3.15p.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72EA0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 761E0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74110000 "rufus-3.15p.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72E20000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 762E0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\imagehlp.dll" at 759D0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\cryptsp.dll" at 72C90000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\rsaenh.dll" at 72C60000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73010000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 73F20000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\riched20.dll" at 72BE0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\usp10.dll" at 72BC0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\msls31.dll" at 72B80000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\clbcatq.dll" at 75270000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\gpedit.dll" at 72A70000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\gpapi.dll" at 72A50000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\activeds.dll" at 72A10000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dssec.dll" at 72A00000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dsuiext.dll" at 72950000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\framedynos.dll" at 72910000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\adsldpc.dll" at 728D0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\authz.dll" at 72890000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dsrole.dll" at 72880000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\logoncli.dll" at 72850000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ntdsapi.dll" at 72830000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\msctf.dll" at 75350000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 73530000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\TextInputFramework.dll" at 734B0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\CoreUIComponents.dll" at 731E0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\CoreMessaging.dll" at 73420000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ntmarta.dll" at 738A0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\WinTypes.dll" at 73110000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\wininet.dll" at 74120000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\WindowsCodecs.dll" at 72CB0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\IconCodecService.dll" at 72B70000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\oleacc.dll" at 72B10000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\iertutil.dll" at 73CE0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\netprofm.dll" at 72AE0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ExplorerFrame.dll" at 726A0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\npmproxy.dll" at 72690000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\devobj.dll" at 73FA0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\OnDemandConnRouteHelper.dll" at 73CC0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\IPHLPAPI.DLL" at 745D0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\winhttp.dll" at 73C10000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\mswsock.dll" at 73BB0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\winnsi.dll" at 73BA0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\nsi.dll" at 74FB0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\urlmon.dll" at 72500000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\msIso.dll" at 724A0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dnsapi.dll" at 72F40000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\rasadhlp.dll" at 73B90000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\FWPUCLNT.DLL" at 72EF0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\schannel.dll" at 72430000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\mskeyprotect.dll" at 72420000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ncrypt.dll" at 72400000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ntasn1.dll" at 723D0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dpapi.dll" at 723C0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\gpapi.dll" at 723A0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\cryptnet.dll" at 72370000 "rufus-3.15p.exe" loaded module "%WINDIR%\System32\en-US\shell32.dll.mui" at 0AA80000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ncryptsslp.dll" at 72350000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\gpedit.dll" at 72240000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\activeds.dll" at 72200000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dssec.dll" at 721F0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dsuiext.dll" at 72140000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\framedynos.dll" at 72100000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\adsldpc.dll" at 720C0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\Wldap32.dll" at 759F0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\authz.dll" at 72080000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\dsrole.dll" at 72070000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\logoncli.dll" at 72040000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\mpr.dll" at 74560000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\netutils.dll" at 72FF0000 "rufus-3.15p.exe" loaded module "%WINDIR%\SysWOW64\ntdsapi.dll" at 720200003b:T18e4,Found reference to API "t MSG_176 " :\\line Krasimir Nevenov \\line Kaloyan Nikolov "" (Indicator: "@yahoo."; File: "RufB984.tmp") Found reference to API "t MSG_176 " :\\line Krasimir Nevenov \\line Kaloyan Nikolov "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 ": \\line Chocobo1 "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Preveo:\\line Dario Komar \\line Saa Vujani "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Preveo:\\line Dario Komar \\line Saa Vujani "" (Indicator: "@hotmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Dansk oversttelse:\\line Jens Hansen \\line Bo Riis \\line Andrea Wood "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Dansk oversttelse:\\line Jens Hansen \\line Bo Riis \\line Andrea Wood "" (Indicator: "@live."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Nederlandse vertaling:\\line Roberto Pino \\line Thomas De Rocker "" (Indicator: "@outlook."; File: "RufB984.tmp") Found reference to API "t MSG_176 " :\\line Konstantinos Margaritis \\line Nikolaos Margaritis \\line Alex F. "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 " :\\line Konstantinos Margaritis \\line Nikolaos Margaritis \\line Alex F. "" (Indicator: "@outlook."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Magyar fordts:\\line Viszokai Gyrgy \\line Csizmadia Gbor "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Magyar fordts:\\line Viszokai Gyrgy \\line Csizmadia Gbor "" (Indicator: "@hotmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Terjemahan Bahasa Indonesia: \\line Abe Akatsuki\\line Arif Budiman "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 ": \\line: Tiryoh "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 ": \\line: Tiryoh "" (Indicator: "@live."; File: "RufB984.tmp") Found reference to API "t MSG_176 " :\\line - \\line Uk-Jin Jang "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Lietuvikas vertimas: Gintaras Venslovas "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Terjemahan Bahasa Malaysia:\\line\n Muhammad Aman \\line\n VGPlayer \\line\n Mohamad Ikhwan bin Kori "" (Indicator: "@yahoo."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Terjemahan Bahasa Malaysia:\\line\n Muhammad Aman \\line\n VGPlayer \\line\n Mohamad Ikhwan bin Kori "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Norsk oversettelse:\\line JED \\line Thorbjrn Bruary \\line Jakub Zieciak "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Norsk oversettelse:\\line JED \\line Thorbjrn Bruary \\line Jakub Zieciak "" (Indicator: "@outlook."; File: "RufB984.tmp") Found reference to API "t MSG_176 " : mailto:s.zia.azimi@gmail.com"" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Polskie tumaczenie:\\line Piotr Halama \\line Poprawki: Krzysztof J. Szklarski\\line Jakub Zieciak "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Tradutores: Tiago Rinaldi \\line\\tab Chateaubriand Vieira Moura "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Traducere n romn de Grlea Alexandru "" (Indicator: "@yahoo."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Preveo:\\line Ivan Strugar \\line Aleksandar Predi \\line Milo Ljubii "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Traduccin al espaol:\\tab Jos Pineda \\line\n\\tab\\tab\\tab MaKK "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Svensk versttning: Sopor "" (Indicator: "@hotmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Trke eviri:\\line Mehmetali KURAN \\line lhami TURAL "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 " : "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Bn dch ting Vit:\\line thanhtai2009 \\line caobach "" (Indicator: "@gmail."; File: "RufB984.tmp") Found reference to API "t MSG_176 "Bn dch ting Vit:\\line thanhtai2009 \\line caobach "" (Indicator: "@outlook."; File: "RufB984.tmp")3c:T909,"rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle32.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ole32.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Users\\%OSUSER%\\AppData\\Local"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Users\\%OSUSER%"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\rufus.app" "$status": "c0000034"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\CRYPTSP.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\rsaenh.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\bcrypt.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\dnsapi.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\powershell.exe"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\rufus.loc" "$status": "c0000034"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Temp"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\rpcss.dll" "$status": "c0000034"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\uxtheme.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\Riched20.DLL"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\USP10.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\msls31.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\System32\\GPEdit.dll"} "rufus-3.15p.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\SysWOW64\\GPAPI.dll"}3d:T4ce,"rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}"; Key: "UPPERFILTERS") "rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}"; Key: "LOWERFILTERS") "rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}"; Key: "UPPERFILTERS") "rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}"; Key: "LOWERFILTERS") "rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{C166523C-FE0C-4A94-A586-F1A80CFBBF3E}"; Key: "UPPERFILTERS") "rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{C166523C-FE0C-4A94-A586-F1A80CFBBF3E}"; Key: "LOWERFILTERS") "rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: "UPPERFILTERS") "rufus-3.15p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: "LOWERFILTERS")3e:T1c9f,"rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "184" "processHandle": "4294967295" "baseAddress": "326b910" "zeroBits": "0" "commitSize": "0" "viewSize": "602112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "656" "processHandle": "4294967295" "baseAddress": "326c8e0" "zeroBits": "0" "commitSize": "0" "viewSize": "102400" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\bcrypt.dll"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "644" "processHandle": "4294967295" "baseAddress": "326b650" "zeroBits": "0" "commitSize": "0" "viewSize": "77824" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "624" "processHandle": "4294967295" "baseAddress": "326b700" "zeroBits": "0" "commitSize": "0" "viewSize": "192512" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "624" "processHandle": "4294967295" "baseAddress": "326c4c0" "zeroBits": "0" "commitSize": "0" "viewSize": "102400" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "696" "processHandle": "4294967295" "baseAddress": "326c200" "zeroBits": "0" "commitSize": "0" "viewSize": "495616" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "700" "processHandle": "4294967295" "baseAddress": "326bd30" "zeroBits": "0" "commitSize": "0" "viewSize": "516096" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "700" "processHandle": "4294967295" "baseAddress": "326b7b0" "zeroBits": "0" "commitSize": "0" "viewSize": "94208" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "700" "processHandle": "4294967295" "baseAddress": "326bbd0" "zeroBits": "0" "commitSize": "0" "viewSize": "204800" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "704" "processHandle": "4294967295" "baseAddress": "103f098" "zeroBits": "0" "commitSize": "0" "viewSize": "32768" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "724" "processHandle": "4294967295" "baseAddress": "326b4f0" "zeroBits": "0" "commitSize": "0" "viewSize": "532480" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326b860" "zeroBits": "0" "commitSize": "0" "viewSize": "1077248" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326bc80" "zeroBits": "0" "commitSize": "0" "viewSize": "122880" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326c2b0" "zeroBits": "0" "commitSize": "0" "viewSize": "65536" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326ca40" "zeroBits": "0" "commitSize": "0" "viewSize": "692224" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326ba70" "zeroBits": "0" "commitSize": "0" "viewSize": "249856" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326b9c0" "zeroBits": "0" "commitSize": "0" "viewSize": "225280" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "768" "processHandle": "4294967295" "baseAddress": "326bf40" "zeroBits": "0" "commitSize": "0" "viewSize": "335872" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326c780" "zeroBits": "0" "commitSize": "0" "viewSize": "204800" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "756" "processHandle": "4294967295" "baseAddress": "326c620" "zeroBits": "0" "commitSize": "0" "viewSize": "36864" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "740" "processHandle": "4294967295" "baseAddress": "326bde0" "zeroBits": "0" "commitSize": "0" "viewSize": "196608" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\en-US\\imageres.dll.mui"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "740" "processHandle": "4294967295" "baseAddress": "326be90" "zeroBits": "0" "commitSize": "0" "viewSize": "94208" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\en-US\\imageres.dll.mui"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "740" "processHandle": "4294967295" "baseAddress": "326c6d0" "zeroBits": "0" "commitSize": "0" "viewSize": "45056" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\en-US\\imageres.dll.mui"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "740" "processHandle": "4294967295" "baseAddress": "326b5a0" "zeroBits": "0" "commitSize": "0" "viewSize": "114688" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\en-US\\imageres.dll.mui"} "rufus-3.15p.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "712" "processHandle": "4294967295" "baseAddress": "326b860" "zeroBits": "0" "commitSize": "0" "viewSize": "1327104" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"}3f:T7cb,"t MSG_265 "VMWare disk detection"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 " VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 " VMWare "" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare "" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Otkrivanje VMware diska"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare detekce disk"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare disk detektering"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare-schijfdetectie"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare-levyn havaitseminen"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Dtection de disque VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMware-Laufwerkserkennung"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 " VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMware lemez szlelse"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Deteksi VMWare disk"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Rilevamento disco VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare "" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Noteikts VMWare disks"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare disko aptikimas"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Pengesanan cakera VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "VMWare-disk oppdagelse"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Wykrywanie dyskw VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Deteco de disco VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "A detetar disco VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 "Detectare disc VMWare"" (Indicator: "vmware") in Source: RufB984.tmp "t MSG_265 " VMWare "" (Indicator: "vmware") in Source: RufB984.tmp40:Tf3e,"rufus-3.15p.exe" wrote bytes "d04c537370645373f0405373003f5373205d5373606b5373f0285473c03c5373" to virtual address "0x73F92078" (part of module "UXTHEME.DLL") "rufus-3.15p.exe" wrote bytes "c0da6b74c0db6b74d07a6c74" to virtual address "0x77C210C0" (part of module "ADVAPI32.DLL") "rufus-3.15p.exe" wrote bytes "e02a6a74f0296a74702a6a74" to virtual address "0x72C8700C" (part of module "RSAENH.DLL") "rufus-3.15p.exe" wrote bytes "10f2747400b97374f091e077109d747490927474c0b4747450887474d067747440b27474209c7474108c7474a0a47474507c747450a97474c0b37474805d7474c0e6747490757474c0ee7474a0c4747400c0747410d2737460aa7474" to virtual address "0x74AC0228" (part of module "COMBASE.DLL") "rufus-3.15p.exe" wrote bytes "b0844373a0aa45735085437380874373f0864373" to virtual address "0x75444000" (part of module "MSCTF.DLL") "rufus-3.15p.exe" wrote bytes "f04c4376c056437630084376c0614276606e437600554376504f4376f0434376501a437650b54576c01b4376f031437650674376" to virtual address "0x762CE164" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "1036f2742036f274" to virtual address "0x74AC01A0" (part of module "COMBASE.DLL") "rufus-3.15p.exe" wrote bytes "907c4376002b43760039437670a24376b0af4376708c407650744076d0d0457660af437680804376b0844376f05f437630a34376" to virtual address "0x762CE060" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "1006dd77" to virtual address "0x73520000" (part of module "TEXTINPUTFRAMEWORK.DLL") "rufus-3.15p.exe" wrote bytes "40d2fc74300dfd74e0f6fc74c0cdfc74" to virtual address "0x761716C4" (part of module "WINDOWS.STORAGE.DLL") "rufus-3.15p.exe" wrote bytes "50d99d7520e49d7510dc9d7570499d75e0429d75" to virtual address "0x753400A0" (part of module "WINTRUST.DLL") "rufus-3.15p.exe" wrote bytes "801f4276a05a4376e0944376d07b4376b01e4276d01d4276f0e34576703f437650fa4076a0804176" to virtual address "0x762CE138" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "40b69a7480de9a74" to virtual address "0x74F9D0E4" (part of module "IMM32.DLL") "rufus-3.15p.exe" wrote bytes "80534e7350f64b7370ed4d73" to virtual address "0x75444024" (part of module "MSCTF.DLL") "rufus-3.15p.exe" wrote bytes "5065467610ed42768072437670c64576" to virtual address "0x762CE04C" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "30ae6e74" to virtual address "0x75B01094" (part of module "RPCRT4.DLL") "rufus-3.15p.exe" wrote bytes "d0d0287590d12875" to virtual address "0x74AC00C4" (part of module "COMBASE.DLL") "rufus-3.15p.exe" wrote bytes "e03a4376e0024376f03d4376" to virtual address "0x762CE000" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "600b3975" to virtual address "0x7352003C" (part of module "TEXTINPUTFRAMEWORK.DLL") "rufus-3.15p.exe" wrote bytes "10764376a05f437630d54076f0564076a0e74576e07b4076b0d64576b024417610454376204d437690e54576" to virtual address "0x762CE19C" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "708cf874503cf874c02df874908ff874c020f874b095f8743025f8747047f874402df874f0bbf8743049f874a026f8744094f874308ef874c080f87450b8f874d027f874c0cef874f026f874d094f874a084f874" to virtual address "0x73710100" (part of module "COMCTL32.DLL") "rufus-3.15p.exe" wrote bytes "d0e44376c0e44376a0dc437620b1437690af4376f0564376e086477620c7437640ec437620ee4376" to virtual address "0x762CE958" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "d05f4076007e4076905c437640984376e0a1407620684376d0d54076104e4076703440763071407600314376807443764012437620424376e0af4376" to virtual address "0x762CE098" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "7058437640c5457640824376009a46768078407600734076d0144376707d4076002d42766076407620774376c07c4076904f40761066437610364376a07e437670a2407630364076" to virtual address "0x762CE0D8" (part of module "GDI32.DLL") "rufus-3.15p.exe" wrote bytes "40d2fc74300dfd74c0cdfc74" to virtual address "0x74AC0058" (part of module "COMBASE.DLL")41:T425,"rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "rufus-3.15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")42:T6c8,Found malicious artifacts related to "185.199.111.153": ... URL: http://blog.oasisfeng.com/wp-content/uploads/2012/07/ (AV positives: 1/89 scanned on 08/17/2021 01:34:07) URL: http://185.199.111.153/ (AV positives: 1/89 scanned on 08/17/2021 00:42:12) URL: https://instab.github.io/fasttickinsta (AV positives: 20/89 scanned on 08/17/2021 00:33:21) URL: https://juandfar.github.io/ (AV positives: 10/89 scanned on 08/17/2021 00:24:53) URL: https://carmenpalencia.github.io/paypalcardgift/ (AV positives: 1/90 scanned on 08/17/2021 00:15:43) File SHA256: 5dede388f2231954b9eb5ea10460a24b645c1c0d5cada5683f08d526eb67041a (AV positives: 7/75 scanned on 08/16/2021 21:51:32) File SHA256: 27fa3ed95575984b11ac305e1eb49848fc0ef8afbd89b0b9731e70cd927b1313 (AV positives: 2/75 scanned on 08/16/2021 21:34:21) File SHA256: 38c221e6893cf25c76682212e6294da85c3db972d805f5d85f40254f920b58ab (AV positives: 3/75 scanned on 08/15/2021 20:28:45) File SHA256: faf029574e171d444e5bd62985468e5cf2713ba5a79bdde2c03176c6cbc360a4 (AV positives: 1/73 scanned on 08/14/2021 23:33:13) File SHA256: 521039118baf06146113490d395d2b83fd75da92d2fe78dd52bc0cc7a8f3ecad (AV positives: 3/74 scanned on 08/14/2021 14:21:51) File SHA256: 44aadf2f565ff3453645683a039cf9127b4f3e4a461a6fab3c9e06d7edc5dcc6 (Date: 08/12/2021 19:59:38) File SHA256: de4e5b9120ba7c1e75d880f4f8bd123d218a25e23e846d69230ee6c91b479f19 (Date: 08/11/2021 09:12:35) File SHA256: f9fc2a0462718b6e8bff71e8f24df43991075eb481343874cdc6d18e50651351 (Date: 07/19/2021 17:07:06) File SHA256: 67e68d6a58aec5f539d6957458790c8671d57d929369000fc49c1e716632cae0 (Date: 07/11/2021 11:49:44) File SHA256: c92f2518b87ad78e54f979617400018d16f2cc21d17cce663f21af4eae48c995 (Date: 07/09/2021 21:13:10)43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3cAAAAAAAAAAAAAAAAHd3d3cAAAAAAAAAAAAAAAd4d3+HcAAAAAAAAAAAAAAHd4iI+HcAAAAAAAAAAAAAB4iP+HiHcAAAAAAAAAAAAAiIj/d4+HAABAAAAAAAAAAAiHeIiI92cARgAAAAAAAAAAh4iIiHd3cAYAAAAAAAAAAAeIiHd3d3cAYAAAAAAAAAAAd3d3d3d3cAYAAAAAAAAAd3d3d3d3d3cAYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3YEYAAAAAAAAHd3d3d3iId3YEYAAAAAAAAHd3d3iIiId3YEYAAAAAAAAHd3iIiIiId3YGAAAAAAAAAHdHiIiIiId3YGAAAAAAAAAAdniIiIiId3YGAAAAAAAAAAd3iIiIiHd3YEAAAAAAAAAAd3iIiHcHd3YAAAAAAAAAAAd3iHcHd3d3QAAAAAAAAAAAd3AHd3d3d3AAAAAAAAAAAAd3d3d3d3d3AAAAAAAAAAAAd3d3d3d3dgAAAAAAAAAAAAd3d3d3ZkAAAAAAAAAAAAAAd2ZAAEAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////v////B////AP///gB///4AP//+AAH//gAA//8AAH//gAB//8AAP//AAB//gAAP/4AAB//AAAP/4AAB//AAAP/4AAB//AAAf/4AAD//gAAf/8AAD//gAAf/8AAH//gAB//8AAf//gAH//8AD///gD///8H///////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1790483967364,"unified_at":"2026-09-27T04:39:27.364Z","metadata":{"hashes":{"sha256":"19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf","sha1":"1388725f70af2829902cdd52baefdeeb9f75bd6f","md5":"69bb28dd11acf510a13dc4193f0c91d9","sha512":"99f7d4b6023a1d9070b91d6b71ff50f20f64afa8f9eebf0f9dad9170b86beb752a7b19ff57c6887582f8ad10ae055844a796e589e65b6cba53356f19cb2aff8b","ssdeep":"24576:CsxAqdu/XYcdIH8FQhyxhD7dK05JoeRIlm71Zl5:NdEYaIceyxh15Tomj5Z/","ssdeep_chunks":["24576:CsxAqdu","24576:sxAqdu/","24576:xAqdu/X","24576:Aqdu/XY","24576:qdu/XYc","24576:du/XYcd","24576:u/XYcdI","24576:/XYcdIH","24576:XYcdIH8","24576:YcdIH8F","24576:cdIH8FQ","24576:dIH8FQh","24576:IH8FQhy","24576:H8FQhyx","24576:8FQhyxh","24576:FQhyxhD","24576:QhyxhD7","24576:hyxhD7d","24576:yxhD7dK","24576:xhD7dK0","24576:hD7dK05","24576:D7dK05J","24576:7dK05Jo","24576:dK05Joe","24576:K05JoeR","24576:05JoeRI","24576:5JoeRIl","24576:JoeRIlm","24576:oeRIlm7","24576:eRIlm71","24576:RIlm71Z","24576:Ilm71Zl","24576:lm71Zl5","49152:CsxAqdu","49152:sxAqdu/","49152:xAqdu/X","49152:Aqdu/XY","49152:qdu/XYc","49152:du/XYcd","49152:u/XYcdI","49152:/XYcdIH","49152:XYcdIH8","49152:YcdIH8F","49152:cdIH8FQ","49152:dIH8FQh","49152:IH8FQhy","49152:H8FQhyx","49152:8FQhyxh","49152:FQhyxhD","49152:QhyxhD7","49152:hyxhD7d","49152:yxhD7dK","49152:xhD7dK0","49152:hD7dK05","49152:D7dK05J","49152:7dK05Jo","49152:dK05Joe","49152:K05JoeR","49152:05JoeRI","49152:5JoeRIl","49152:JoeRIlm","49152:oeRIlm7","49152:eRIlm71","49152:RIlm71Z","49152:Ilm71Zl","49152:lm71Zl5","24576:NdEYaIc","24576:dEYaIce","24576:EYaIcey","24576:YaIceyx","24576:aIceyxh","24576:Iceyxh1","24576:ceyxh15","24576:eyxh15T","24576:yxh15To","24576:xh15Tom","24576:h15Tomj","24576:15Tomj5","24576:5Tomj5Z","24576:Tomj5Z/"],"imphash":"7326001be3ced77b153640be93a8dff6"},"file_info":{"file_name":"rufus-3.15.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1181752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1628006250000,"last_seen":1780803396000,"last_multi_scan":1780803396000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["autorun","delf","bancteian","banker","floxif","dridex","riskware","dropper","pup","conduit","virut","simda","spyware","xrat","swrort","adware","citadel","filetour","rat","worm","backdoor","ramnit","trojan","installcore","emotet","zeus","adload","zbot","xtrat","unruy","botnet","exploit","pua","downloader","evasive","windows-server-utility","kryptik","stealer","agent","hacktool","metasploit","meterpreter"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":134,"suspicious_count":23,"malicious_count":8,"total":165},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies Windows Auto-Updates feature"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Privilege Escalation","technique":"Group Policy Modification","attack_id":"T1484.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1484/001","identifiers":[{"type":"malicious","value":"Modifies Group policy settings registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable Windows defender via registry"},{"type":"malicious","value":"Tries to disable Windows defender Anti Spyware"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"malicious","value":"Reads VM specific registry key"},{"type":"malicious","value":"Reads the registry for VMWare specific artifacts"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic process information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API typically used to terminate process and its threads"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"},{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$22","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$23","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"rufus-3.15.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007636.00000000.140464.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Extra hashes (SHA512)\" (Indicator: \"SHA512\"; Source: \"00000000-00007636.00000000.140464.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; File: \"rufus-3.15.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007636.00000000.140464.013E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.961961273073197","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"z1 = https://github.com/pbatard/Fido/releases/download/v1.65/Fido.ps1.lzma\" (Indicator: \"github.com\"; File: \"Fido_1_.ver\")\n Found string \"github.com\" (Indicator: \"github.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007636-00000C2B-1184707620\")\n Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00007636-00000C2B-1184707650\")\n Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"00000000-00007636-00000C2B-1184707678\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00007636-00000C2B-1184709032\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00007636-00000C2B-1184709239\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007636-00000C2B-1184709268\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rufus-3.15.exe\" called \"SetupDiGetClassDevsA\" with parameters (UID: 00000000-00007636)\n \"rufus-3.15.exe\" called \"SetupDiGetDeviceRegistryPropertyA\" with parameters (UID: 00000000-00007636)\n \"rufus-3.15.exe\" called \"SetupDiGetDeviceRegistryPropertyW\" with parameters (UID: 00000000-00007636)\n \"rufus-3.15.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rufus-3.15.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"rufus-3.15.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"rufus-3.15.exe\" called \"IsWow64Process\" with parameter \"7636\" - (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$24","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rufus-3.15.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"rufus-3.15.exe\" called \"GetVersionExA\" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007636)\n \"rufus-3.15.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d580000020000000007d8000000d80000000000000000000000000018fb3f01000000000000000050fb1e010200000010000000c001d80000000000020000000000d800010000000800000000003e01740ad80000000000700ad800c8e91f01feba7b770800000000000000080000001b5c6d310cec1f01da914c7300003e010800000001000000 (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rufus-3.15.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"5227482038,8740,109,,GetWindowTextW,user32.dll,\"00:36:31.984\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007636.00000000.140464.013E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"rufus-3.15.exe\")\n Found reference to API \"\" (Indicator: \"GetVersion\"; Source: \"00000000-00007636.00000000.140464.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rufus-3.15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rufus-3.15.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"rufus-3.15.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUFUS-3.15.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.199.108.153:443\"\n \"140.82.112.4:443\"\n \"185.199.111.133:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: rufus-3.15.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"rufus-3.15.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007636.00000000.140464.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\" in Source: 00000000-00007636.00000000.140464.013E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global/Rufus\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7636:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7636:64:WilError_03\"\n \"Local\\SM0:7636:64:WilError_03\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:7636:168:WilStaging_02\"\n \"SM0:7636:64:WilError_03\"\n \"DBWinMutex\"\n \"Global/Rufus\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7636:64:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"rufus-3.15.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"z1 = https://github.com/pbatard/Fido/releases/download/v1.65/Fido.ps1.lzma\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"rufus-3.15.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73460000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rufus-3.15.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 760B0000\n \"rufus-3.15.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73C80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rufus-3.15.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76840000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"rufus-3.15.exe\" was detected as \"UPX\" and name: \"Packer\"\n \"rufus-3.15.exe\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"rufus-3.15.exe\" touched \"Group Policy Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{EA502722-A23D-11D1-A7D3-0000F87571E3}\")\n \"rufus-3.15.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\\TREATAS\")\n \"rufus-3.15.exe\" touched \"Network List Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\TREATAS\")\n \"rufus-3.15.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\TREATAS\")\n \"rufus-3.15.exe\" touched \"MSAA AccPropServices\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\\TREATAS\")\n \"rufus-3.15.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"rufus-3.15.exe\" has an executable section named \"UPX0\"\n \"rufus-3.15.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"rufus-3.15.exe\" has an writable section named \"UPX0\"\n \"rufus-3.15.exe\" has an writable section named \"UPX1\"\n \"rufus-3.15.exe\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"rufus-3.15.exe\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x635015,lea\tedi, [esi - 0x234015],push\tedi,mov\tebp, esp,lea\tebx, [esp - 0x3e80],xor\teax, eax,push\teax,cmp\tesp, ebx,jne\t0x748708,inc\tesi,inc\tesi,push\tebx,push\t0x346cd9,push\tedi,add\tebx, 4,push\tebx,push\t0x1136d9,push\tesi,add\tebx, 4,push\tebx,push\teax,mov\tdword ptr [ebx], 0x20003,push\tebp,push\tedi,push\tesi,push\tebx,sub\tesp, 0x7c,mov\tedx, dword ptr [esp + 0x90],mov\tdword ptr [esp + 0x74], 0,mov\tbyte ptr [esp + 0x73], 0,mov\tebp, dword ptr [esp + 0x9c],lea\teax, [edx + 4],mov\tdword ptr [esp + 0x78], eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x114400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x234000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x115000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"]jBkAv\" (Indicator: \"bkav\") in Source: rufus-3.15.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"github.com\"\n \"release-assets.githubusercontent.com\"\n \"rufus.ie\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"rufus-3.15.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rufus-3.15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rufus-3.15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rufus-3.15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00007636-00000C2A-1184739049]\n Observed system executable string:\"%WINDIR%\\Sysnative\\en-US\\shell32.dll.mui\" [Source: 00000000-00007636-00000C2A-1190210147]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"rufus-3.15.exe\" searching for window \"Rufus 3.15.1812\"\n \"rufus-3.15.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2c","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"rufus-3.15.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"rufus-3.15.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Ruf6E98.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"rufus-3.15.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007636.00000000.140464.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rufus-3.15.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Ruf6E98.tmp\" has type \"Unicode text UTF-8 text with very long lines (555) with CRLF line terminators\"- Location: [%TEMP%\\Ruf6E98.tmp]- [targetUID: 00000000-00007636]\n \"Registry.pol\" has type \"Group Policy Registry Policy Version=1\"- Location: [%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol]- [targetUID: 00000000-00007636]\n \"gpt.ini\" has type \"ASCII text with CRLF line terminators\"- Location: [%WINDIR%\\System32\\GroupPolicy\\gpt.ini]- [targetUID: 00000000-00007636]\n \"Fido_1_.ver\" has type \"ASCII text\"- [targetUID: 00000000-00007636]\n \"gpt.ini\" has type \"ASCII text with CRLF line terminators\"- Location: [%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini]- [targetUID: 00000000-00007636]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Ruf6E98.tmp\" has type \"Unicode text UTF-8 text with very long lines (555) with CRLF line terminators\" - Location: [%TEMP%\\Ruf6E98.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rufus-3.15.exe\" queries basic process information of the \"C:\\rufus-3.15.exe\" (UID: 7636)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rufus-3.15.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ruf6e98.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM)\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Calls an API typically used to enumerate device information\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rufus-3.15.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"rufus-3.15.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ruf6e98.tmp\"\n \"rufus-3.15.exe\" writes file \"c:\\windows\\syswow64\\grouppolicy\\gpt.ini\"\n \"rufus-3.15.exe\" writes file \"c:\\windows\\system32\\grouppolicy\\machine\\registry.pol\"\n \"rufus-3.15.exe\" writes file \"c:\\windows\\system32\\grouppolicy\\gpt.ini\"\n \"rufus-3.15.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\6ldiekeg\\fido[1].ver\"\n \"rufus-3.15.exe\" writes file \"%temp%\\ruf6e98.tmp\"\n \"rufus-3.15.exe\" writes file \"%windir%\\syswow64\\grouppolicy\\gpt.ini\"\n \"rufus-3.15.exe\" writes file \"%windir%\\system32\\grouppolicy\\machine\\registry.pol\"\n \"rufus-3.15.exe\" writes file \"%windir%\\system32\\grouppolicy\\gpt.ini\"\n \"rufus-3.15.exe\" writes file \"%localappdata%\\microsoft\\windows\\inetcache\\ie\\6ldiekeg\\fido[1].ver\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"rufus-3.15.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /Fido.ver\" - (UID: 00000000-00007636), \"rufus-3.15.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /pbatard/Fido/releases/download/v1.65/Fido.ps1.lzma\" - (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"rufus-3.15.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"rufus-3.15.exe\" called \"InternetOpenA with parameter Rufus/3.15.1812 (Windows NT 10.0; WOW64)\" (UID: 00000000-00007636)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007636-00000C2B-1189185282\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007636-00000C2B-1189185447\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007636-00000C2B-1189185779\")\n Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00007636-00000C2B-1189185921\")\n Found reference to API \"HttpQueryInfoA\" (Indicator: \"HttpQueryInfo\"; Source: \"00000000-00007636-00000C2B-1189186048\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007636-00000C2B-1189200582\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"release-assets.githubusercontent.com\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.4.17\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.9\"\n \"2.5.4.10\"\n \"2.5.4.3\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n \"2.5.4.6\"\n \"2.5.29.19\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"bh.sh\"\n Heuristic match: \"8uk.es\"\n Heuristic match: \".0s.nf\"\n Heuristic match: \"sp.am\"\n Heuristic match: \"vu.hk\"\n Pattern match: \"https://rufus.ie\"\n Pattern match: \"https://www.gnu.org/licenses/gpl-3.0.html\"\n Pattern match: \"https://github.com/pbatard/fido/releases/download/v1.65/fido.ps1.lzma\"\n Heuristic match: \"/rufus.ie\"\n Pattern match: \"www.gnu.org/licenses/gpl-3.0.html\"\n Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"\n Heuristic match: \"github.com\"\n Heuristic match: \"release-assets.githubusercontent.com\"\n Heuristic match: \"rufus.ie\"\n Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\"\n Pattern match: \"http://schemas.microsoft.com/smi/2019/windowssettings\"\n Heuristic match: \"exe;.bat;.cy\"\n Pattern match: \"http://ts-aia.ws\"\n Pattern match: \"https://secure.comodo.net/cps0c\"\n Heuristic match: \"mailto:pete@akeo.ie\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://rufus.iecompanynameakeo\" - Source: \"00000000-00007636.00000000.140464.00D5A000.00000004.mdmp\")\n Found URL \"https://www.gnu.org/licenses/gpl-3.0.htmloriginalfilenamerufus-3.15.exeproductnamerufusproductversion3.15.1812varfileinfotranslation6667555@iiio:::llljsssetttuuu7^^^\" - Source: \"00000000-00007636.00000000.140464.00D5A000.00000004.mdmp\")\n Found URL \"http://ts-aia.ws..com/sharpc/u)\" - Source: \"00000000-00007636.00000000.140464.013E0000.00000004.mdmp\")\n Found URL \"https://secure.comodo.net/cps0c<0:082http:/x www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rufus-3.15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"rufus-3.15.exe\" has a section named \"UPX0\"\n \"rufus-3.15.exe\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"rufus-3.15.exe\" has section name UPX1 with entropy \"7.999793640308535\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"rufus-3.15.exe\" reads file \"C:\\Windows\\SysWOW64\\GroupPolicy\\gpt.ini\"\n \"rufus-3.15.exe\" reads file \"C:\\Windows\\System32\\GroupPolicy\\gpt.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.199.108.153 on port 443 is sent without HTTP header\n TCP traffic to 140.82.112.4 on port 443 is sent without HTTP header\n TCP traffic to 185.199.111.133 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"rufus-3.15.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1085a\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1085a\"\n \"cx\": \"88\"\n \"cy\": \"26\"}\n \"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1085a\"\n \"cx\": \"133\"\n \"cy\": \"26\"}\n \"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10b75\"\n \"cx\": \"17\"\n \"cy\": \"551\"}\n \"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1010b00\"\n \"cx\": \"17\"\n \"cy\": \"30\"}\n \"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1010b00\"\n \"cx\": \"444\"\n \"cy\": \"23\"}\n \"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1010b00\"\n \"cx\": \"444\"\n \"cy\": \"25\"}\n \"rufus-3.15.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"108f8\"\n \"cx\": \"95\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"rufus-3.15.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"rufus-3.15.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido[1].ver\" with delete access\n \"rufus-3.15.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido.ps1[1].lzma\" with delete access\n \"rufus-3.15.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Ruf6E98.tmp\" with delete access\n \"rufus-3.15.exe\" opened \"C:\\rufus.com\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"rufus-3.15.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"rufus-3.15.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n LoadLibraryA\n ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"rufus-3.15.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads VM specific registry key","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the registry for VMWare specific artifacts","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-56","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender via registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-77","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"level":"malicious","category":"System Security","name":"Modifies Group policy settings registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1484.001","relevance":5,"id":"registry-148","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"malicious","category":"System Security","name":"Modifies Windows Auto-Updates feature","description":"\"rufus-3.15.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")\n \"rufus-3.15.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{37727635-E858-4E69-AB08-4B894D3E43A5}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-24","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001760.00000000.78742.00820000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"X ^ d j p v |\" (Indicator: \" ^ \"; Source: \"00000000-00001760.00000000.78742.03250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"RufB984.tmp\")\n Found string \"t MSG_125 \"Set the size of the persistent partition for live USB media. Setting the size to 0 disables the persistent partition.\"\" (Indicator: \"\"set \"; File: \"RufB984.tmp\")\n Found string \"t MSG_126 \"Set the partition size units.\"\" (Indicator: \"\"set \"; File: \"RufB984.tmp\")\n Found string \"t MSG_126 \"Set saiz unit pemetakan.\"\" (Indicator: \"\"set \"; File: \"RufB984.tmp\")\n Found string \"Set the partition size units.\" (Indicator: \"set \"; Source: \"00000000-00001760.00000000.78742.03100000.00000004.mdmp\")\n Found string \"Set the size of the persistent partition for live USB media. Setting the size to 0 disables the persistent partition.\" (Indicator: \"set \"; Source: \"00000000-00001760.00000000.78742.05C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/70 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\"rufus-3.15p.exe\" loaded module \"C:\\rufus-3.15p.exe\" at 00820000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$3a","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"rufus-3.15p.exe\" allocated memory in \"C:\\rufus-3.15p.exe\" with (Protection: \"read/write\")\n \"rufus-3.15p.exe\" allocated memory in \"C:\\rufus-3.15p.exe\" with (Protection: \"no access\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic process information of the specified process","description":"\"rufus-3.15p.exe\" queries basic process information of the \"C:\\rufus-3.15p.exe\" (UID: 1760)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"rufus-3.15p.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001760)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"rufus-3.15p.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00001760)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"\"rufus-3.15p.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLEAE84D2AA5155F7D24BD194D3E1AA (UID: 00000000-00001760)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"\"copy mode.\\nAs a result\n DD image writing mode will be enforced.\"\" (Indicator: \"\"copy \") in Source: RufB984.tmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"\"rufus-3.15p.exe\" called \"NtOpenProcessToken\" (UID: 00000000-00001760)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"\"rufus-3.15p.exe\" called \"NtOpenThreadToken\" (UID: 00000000-00001760)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"rufus-3.15p.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\rufus-3.15p.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$3e","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found string \"winlogon.exe\" (Indicator: \"svchost.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\"; Source: \"00000000-00001760.00000000.78742.052C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.99979364031","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00001760.00000000.78742.052C0000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00001760.00000000.78742.052C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"rufus-3.15p.exe\" marked \"C:\\rufus.ini~\" for deletion\n \"rufus-3.15p.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\RufB984.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$40","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender Anti Spyware","description":"\"rufus-3.15p.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E47893A7-A9DB-4DF1-9007-70571372B9BB}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")\n \"rufus-3.15p.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{945CD5E9-1CBE-4A91-969E-5077ECD71540}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-76","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"rufus.ie\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"rufus-3.15.exe\" created file \"%TEMP%\\RufEFE0.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"rufus-3.15.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"rufus-3.15.exe\" at 00070784-00003724-00000105-9136574558627094","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"rufus-3.15.exe\" read file \"%WINDIR%\\System32\\GroupPolicy\\gpt.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"rufus-3.15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"rufus-3.15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"\"rufus-3.15.exe\" (Access type: \"CREATE\"; Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")\n \"rufus-3.15.exe\" (Access type: \"CREATE\"; Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"rufus-3.15.exe\" (Access type: \"CREATE\"; Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")\n \"rufus-3.15.exe\" (Access type: \"CREATE\"; Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\")\n \"rufus-3.15.exe\" (Access type: \"CREATE\"; Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"rufus-3.15.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$42","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"rufus-3.15p.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Reads VM specific registry key"},{"detail":"Reads the registry for VMWare specific artifacts"},{"detail":"Tries to disable Windows defender via registry"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":137,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":56,"files_deleted_count":0,"registry_keys_created_count":37,"registry_keys_modified_count":0,"registry_keys_deleted_count":37,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":74,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":4,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["autorun","delf","bancteian","banker","floxif","dridex","riskware","dropper","pup","conduit","virut","simda","spyware","xrat","swrort","adware","citadel","filetour","rat","worm","backdoor","ramnit","trojan","installcore","emotet","zeus","adload","zbot","xtrat","unruy","botnet","exploit","pua","downloader","evasive","windows-server-utility","kryptik","stealer","agent","hacktool","metasploit","meterpreter"],"sample_flags":["Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"68750cc6afebe070930fcbdf","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"clean","contacted_countries":["NLD","USA"],"submit_name":"rufus-3.15.exe","analysis_start_time":"2025-07-14T13:57:27+00:00","indicators_count":{"informative":106,"suspicious":47,"malicious":5},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"64624a141f41c1c52c06c035","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"clean","threat_score":100,"contacted_countries":["NLD"],"submit_name":"rufus-3.15p.exe","analysis_start_time":"2023-05-15T15:04:53+00:00","indicators_count":{"informative":109,"suspicious":42,"malicious":3},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"611b181b3d6c25379e55e3c4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","contacted_countries":["NLD"],"submit_name":"rufus-3.15.exe","analysis_start_time":"2021-08-17T01:59:58+00:00","indicators_count":{"informative":16,"suspicious":21,"malicious":1},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"6109676938cd492ae52930d2","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"clean","contacted_countries":["NLD","USA"],"submit_name":"rufus-3.15p.exe","analysis_start_time":"2021-08-03T15:57:37+00:00","indicators_count":{"informative":16,"suspicious":23,"malicious":2},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.199.108.153","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"address":"140.82.112.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"address":"185.199.111.133","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"address":"185.199.111.153","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}],"dns_resolutions":[{"domain":"github.com","address":"140.82.112.4","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"ns-421.awsdns-52.com.","registrar_creation_date":"2007-10-09T11:20:50+00:00","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"domain":"release-assets.githubusercontent.com","address":"185.199.111.133","ttl":2840,"country":"Netherlands","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"ns4.p16.dynect.net.","registrar_creation_date":"2014-02-06T13:17:00+00:00","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"domain":"rufus.ie","address":"185.199.108.153","ttl":1526,"country":"Netherlands","registrar_name_servers":"ns4.blacknight.com","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"domain":"crl.identrust.com","address":"184.28.41.152","ttl":8761,"country":"United States","registrar_name":"NETWORK SOLUTIONS, LLC.","registrar_name_servers":"NS.IDENTRUST.COM","registrar_creation_date":"2004-02-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}],"processes":[{"pid":7636,"ppid":0,"name":"rufus-3.15.exe","command_line":"","sha256":"19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf","normalized_path":"C:\\rufus-3.15.exe","uid":"00000000-00007636","icon":"$43"}],"all_imported_dlls":["cfgmgr32.dll","windows.storage.dll","ntasn1.dll","dpapi.dll","dssec.dll","setupapi.dll","cryptsp.dll","oleaut32.dll","riched20.dll","activeds.dll","CoreUIComponents.dll","wow64con.dll","ws2_32.dll","msls31.dll","ExplorerFrame.dll","urlmon.dll","ncrypt.dll","wow64.dll","rpcrt4.dll","user32.dll","win32u.dll","VxSSL32.dll","adsldpc.dll","winhttp.dll","dsrole.dll","wow64cpu.dll","KernelBase.dll","authz.dll","comdlg32.dll","msasn1.dll","imagehlp.dll","gpedit.dll","schannel.dll","Wldap32.dll","wow64win.dll","sspicli.dll","WinTypes.dll","bcrypt.dll","gpapi.dll","TextShaping.dll","iertutil.dll","rasadhlp.dll","wintrust.dll","gdi32full.dll","gdi32.dll","SHCore.dll","msctf.dll","TextInputFramework.dll","CoreMessaging.dll","IPHLPAPI.DLL","wow64base.dll","shlwapi.dll","shell32.dll","bcryptprimitives.dll","logoncli.dll","srvcli.dll","dnsapi.dll","ncryptsslp.dll","msvcrt.dll","comctl32.dll","ole32.dll","dsuiext.dll","wininet.dll","oleacc.dll","winnsi.dll","nsi.dll","msvcp_win.dll","imm32.dll","kernel.appcore.dll","usp10.dll","ntdsapi.dll","cryptnet.dll","netprofm.dll","npmproxy.dll","OnDemandConnRouteHelper.dll","cryptbase.dll","uxtheme.dll","framedynos.dll","WindowsCodecs.dll","devobj.dll","mswsock.dll","FWPUCLNT.DLL","mpr.dll","kernel32.dll","fltLib.dll","profapi.dll","clbcatq.dll","IconCodecService.dll","netutils.dll","combase.dll","crypt32.dll","advapi32.dll","ucrtbase.dll","rsaenh.dll","ntdll.dll","sechost.dll","msIso.dll","ntmarta.dll","mskeyprotect.dll","powrprof.dll","dwmapi.dll","wtsapi32.dll","wshqos.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","RpcRtRemote.dll","atl.dll","wkscli.dll","imageres.dll","version.dll","lpk.dll","netapi32.dll","slc.dll","secur32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","samcli.dll","SensApi.dll","normaliz.dll","api-ms-win-core-synch-l1-2-0.dll","nlaapi.dll","dhcpcsvc.dll","userenv.dll","oleaccrc.dll","dhcpcsvc6.dll","rpcss.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","duser.dll","dui70.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","credssp.dll","wship6.dll","dfscli.dll","WSHTCPIP.DLL","webio.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Ruf6E98.tmp","sha256":"b66aaebaa8fd9df231702f371ce908bf8a79bf831553e413679b1269ca7eb605","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"gpt.ini","sha256":"77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Registry.pol","sha256":"418bea8e0794e63b3cf824d7ea01eef1a722b5459348b5d814d8fdac504a7626","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Fido_1_.ver","sha256":"e60fd87875bca7de92be097b792657cbf67ac6d7771750318c87d311e2edfcde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"RufB984.tmp","sha256":"b66aaebaa8fd9df231702f371ce908bf8a79bf831553e413679b1269ca7eb605","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"name":"rufus.ini","sha256":"5c0c13c9deb05e550899e94a2126069844dac714affabb3b1b17e0cbe351755c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"rufus.ini~","sha256":"5c0c13c9deb05e550899e94a2126069844dac714affabb3b1b17e0cbe351755c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"9d22ae84f353b9ba61b41d544b4276719b425881f7c62d556a253ac78bfdefdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"RufEFE0.tmp","sha256":"b66aaebaa8fd9df231702f371ce908bf8a79bf831553e413679b1269ca7eb605","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"name":"644B8874112055B5E195ECB0E8F243A4","sha256":"58a4b66abde4fccc95b5ed9d57794962702328db6f654e1aee0500848b69679d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Ruf351D.tmp","sha256":"b66aaebaa8fd9df231702f371ce908bf8a79bf831553e413679b1269ca7eb605","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"GPT.INI","sha256":"c94d19972596583b944366b291a1d48b357e88835e7218e0f0d184ac1e29f05a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"path":"%TEMP%\\Ruf6E98.tmp","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"path":"%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\gpt.ini","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido[1].ver","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido.ps1[1].lzma","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"path":"%LOCALAPPDATA%\\Rufus\\rufus.log","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%LOCALAPPDATA%\\RUFUS\\RUFUS.LOG","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"C:\\rufus.ini","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"C:\\rufus-3.15.exe","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\System32\\en-US\\gpedit.dll.mui","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\User","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\User\\Registry.pol","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\en-US\\comdlg32.dll.mui","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\comdlg32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"C:\\rufus-3.15p.exe","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\gpedit.dll.mui","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\GPT.INI","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}USER\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWS SEARCH\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\SPYNET\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"POLICIES\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}USER\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\NODRIVETYPEAUTORUN\\NODRIVETYPEAUTORUN","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}USER\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWS SEARCH\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FDB26BF7-B955-4899-9301-58E6A6CA5917}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\SPYNET\\","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{7785E074-AF35-4026-843A-D06A82BB4236}USER\\","sources":[{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global/Rufus","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7636:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"Local\\SM0:7636:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Local\\SM0:7636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"SM0:7636:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Global/Rufus","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7636:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"611b181b3d6c25379e55e3c4"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68750cc6afebe070930fcbdf"},{"report_type":"sandbox","report_id":"6109676938cd492ae52930d2"}]},{"name":"SM0:1760:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]},{"name":"Local\\SM0:1760:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64624a141f41c1c52c06c035"}]}]}},"report_ids":{"sandbox_job_ids":["64624a141f41c1c52c06c035","68750cc6afebe070930fcbdf","611b181b3d6c25379e55e3c4","6109676938cd492ae52930d2"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Clean Sample 19a2f7bd08cb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 19a2f7bd08cb…. Threat score 0/100. 0/27 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 19a2f7bd08cb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 19a2f7bd08cb…. Threat score 0/100. 0/27 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/19a2f7bd08cb6711937a71adae9d13bbe8a3af08d3551d121c2d7f84ec3d7aaf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 19a2f7bd08cb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 19a2f7bd08cb…. Threat score 0/100. 0/27 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]