25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T42a,"rufus-3.17.exe" called "FindResourceA" with parameter "500" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "101" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "103" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "106" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "125" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "126" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "401" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "403" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "121" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "122" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "123" - (UID: 00000000-00008128) "rufus-3.17.exe" called "FindResourceA" with parameter "124" - (UID: 00000000-00008128)27:T5ec,"rufus-3.17.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11541856'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11538872'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11538952'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11539072'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11539896'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11539936'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11541576'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11541656'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11539736'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11539776'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11539816'}" (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadResource with parameter {'hModule': '7536640', 'hResInfo': '11539856'}" (UID: 00000000-00008128)28:T6b9,"rufus-3.17.exe" called "GetWindowTextW" with parameter "More information" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Do you want to allow Rufus to check for application updates online?" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "4e006f00" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Yes" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "START" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "CLOSE" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "SELECT" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Use Rufus MBR with BIOS ID" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Check device for bad blocks" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "List USB Hard Drives" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Add fixes for old BIOSes (extra partition, align, etc.)" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Quick format" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Create extended label and icon files" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextA" with parameter "Rufus 3.17.1846" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Drive Properties" - (UID: 00000000-00008128) "rufus-3.17.exe" called "GetWindowTextW" with parameter "Format Options" - (UID: 00000000-00008128)29:T1154,"rufus-3.17.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008128) "rufus-3.17.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008128) "rufus-3.17.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000c703927eec7600002f010000000018a02f016154d645b06b3473ec1d3473c8e4c703b06b347300002f0118000000000000008000000008e4c703010000008ce4c70370e1ed76b06b3473009d357302000000ae80ed7618a02f015ce4c7037587ee761c93f3769ce4c7033d7cee76080000009580ed767b80ed76b954d645b06b3473ec1d347302000000b06b3473009d357302000000d4e4c70370e1ed76a0e4c7037587ee761c93f376e4e4c70399653573080000007d653573bf47011db06b3473ec1d347302000000009d357360a02f0118a02f01b0e4c703968b347384e5c703306b3573d373f06dfefffffff0e4c703ae653573009d357308e5c703 (UID: 00000000-00008128) "rufus-3.17.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008128) "rufus-3.17.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000ebb100010000b8b8c9009ce55f00201bf075000000006833c9005017ca73eb1deb7500000000c8e55f006017ca738433c90096f1c9736c9640ab508bc8006833c90000000000130000003017ca735017ca736833c90000000000000000004ce65f004ce65f006017ca738433c90077cec9736033c900508bc80087cec97300000000000000006033c900000000003017ca7398000000508bc8002ce65f00201bf075ffffffff3ce65f00101eeb757455a63830e3ebb128e65f00681080778433c90020000000b8b2c4006033c9000ec03277fe0d4d7c00000000508bc800d5b2c4001000000000b7c97330e65f0070cdc9736ce75f00b0ba3977fef55b0b (UID: 00000000-00008128) "rufus-3.17.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000d4d45f006820eb750300000000000000d8d1ebb1109af5720000000014d55f00201bf075ffffffff24d55f005810eb753c10eb7528d0ebb1109af572d445f572d845f57204d55f0000d55f000d0000000d0000009003f772dc54f972000000006cacf672d858f97298d55f00608dee75441043c4feffffff30d55f00900feb759003f77240d55f0084d4f672dc54f9729003f7724cd55f00a4d4f6729003f77268d55f001a9af5729003f772528bea75010000000100000017d4f672a8d55f0086caf672000000004acaf672ce16d235010000000100000000000000000000000000000078d55f003dba19f4e8d55f00f0ccf672deef7447feffffff (UID: 00000000-00008128) "rufus-3.17.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000003b07927eec7600002f0100000000e80f940351522a41b06b8c72ec1d8c72f8e23b07b06b8c7200002f0118000000000000008000000038e23b0701000000bce23b0770e1ed76b06b8c72009d8d7202000000ae80ed76e80f94038ce23b077587ee761c93f376cce23b073d7cee76080000009580ed767b80ed76e9522a41b06b8c72ec1d8c7202000000b06b8c72009d8d720200000004e33b0770e1ed76d0e23b077587ee761c93f37614e33b0799658d72080000007d658d72498886f2b06b8c72ec1d8c7202000000009d8d7230109403e80f9403e0e23b07968b8c72b4e33b07306b8d72d5bb3387feffffff20e33b07ae658d72009d8d7238e33b07 (UID: 00000000-00008128)2a:T8c4,"rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2b:T515,"rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5"; Key: "BLOB") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\742C3192E607E424EB4549542BE1BBC53E6174E2"; Key: "BLOB") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\7E04DE896A3E666D00E687D33FFAD93BE83D349E"; Key: "BLOB") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436"; Key: "BLOB") "rufus-3.17.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AD7E1C28B064EF8F6003402014C3D0E3370EB58A"; Key: "BLOB")2c:T7e8,"rufus-3.17.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter COMCTL32.DLL (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter COMDLG32.DLL (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter Riched20 (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter WinInet (UID: 00000000-00008128) "rufus-3.17.exe" called "LoadLibrary" with a parameter %WINDIR%\Sysnative\en-US\shell32.dll.mui (UID: 00000000-00008128)2d:Tce83,"rufus-3.17.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter AttachConsole (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DefineDosDeviceA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DeleteVolumeMountPointA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter EnumUILanguagesW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FindFirstVolumeA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FindNextVolumeA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FindVolumeClose (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSystemDefaultLangID (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetVolumeNameForVolumeMountPointA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetVolumePathNameA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter K32GetModuleFileNameExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter K32GetProcessImageFileNameW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter QueryDosDeviceA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetDllDirectoryA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetThreadAffinityMask (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetVolumeLabelA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetVolumeMountPointA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter VerifyVersionInfoA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptVerifySignatureW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegDeleteKeyA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegLoadKeyA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RegUnLoadKeyA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorOwner (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ImageList_ReplaceIcon (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CommDlgExtendedError (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetOpenFileNameW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSaveFileNameW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CertGetNameStringA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptDecodeObjectEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptMsgOpenToDecode (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptMsgUpdate (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreatePen (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter EnumFontFamiliesExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetTextFaceW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LineTo (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MoveToEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter Rectangle (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetDCPenColor (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __getmainargs (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __initenv (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __p___argv (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __p__acmdln (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __p__commode (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __set_app_type (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _access (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _assert (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _atoi64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _chdir (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _close (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _filelengthi64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _fileno (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _flushall (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _fstati64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _iob (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _lseeki64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _mkdir (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _open_osfhandle (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _open (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _read (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _setjmp3 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _snprintf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _snprintf_s (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _snwprintf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _splitpath (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _stati64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _strcmpi (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _strnicmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _strtoi64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _tzset (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _vscprintf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _vsnprintf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _waccess (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wchdir (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wcsnicmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wfopen_s (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wmkdir (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _write (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wsopen_s (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wstat64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wstati64 (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter _wunlink (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter atoi (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter atol (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter clearerr (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter feof (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ferror (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fflush (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fgetpos (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fgets (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fgetws (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fputs (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fputws (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter freopen (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fseek (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fsetpos (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ftell (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fwprintf_s (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter getc (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter gmtime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter getenv (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter isalpha (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter islower (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter isspace (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter isupper (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter localtime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter longjmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter mktime (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter printf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter putchar (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter puts (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter qsort (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter setlocale (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter rename (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter setvbuf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strcat (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strncat (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strspn (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strtok (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strtol (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter strtoul (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter time (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter toupper (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcscpy (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcsncat (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcsncmp (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcsncpy (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcsspn (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcsstr (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wcstombs (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Get_Child (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Get_DevNode_Status (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Get_Device_IDA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Get_Device_ID_ListA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Get_Device_ID_List_SizeA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Get_Parent (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Get_Sibling (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CM_Locate_DevNodeA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiChangeState (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInfo (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInstanceIdA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetupDiSetClassInstallParamsW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DragQueryFileW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHBrowseForFolderW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHChangeNotifyDeregister (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHChangeNotifyRegister (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHCreateDirectoryExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHFileOperationW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SHSimpleIDListFromPath (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter PathFileExistsA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter PathFileExistsW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter PathGetDriveNumberW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter wnsprintfW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CharUpperBuffW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CheckDlgButton (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CopyRect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateDialogIndirectParamW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateIconIndirect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreatePopupMenu (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DestroyMenu (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DialogBoxIndirectParamW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DrawIconEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DrawTextExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FindWindowExA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter FlashWindowEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetDlgItemTextW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InflateRect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InsertMenuW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter IsDlgButtonChecked (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MapDialogRect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MessageBeep (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MessageBoxExW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter PostQuitMessage (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SendDlgItemMessageA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetDlgItemTextA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetDlgItemTextW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetProcessDefaultLayout (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter TrackPopupMenuEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter UnhookWinEvent (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter WinVerifyTrustEx (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter __wgetmainargs (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter NtOpenProcessToken (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter NtAdjustPrivilegesToken (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00008128) "rufus-3.17.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00008128)2e:T868,Found reference to API (Indicator: "FreeSid"; File: "rufus-3.17.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "rufus-3.17.exe") Found reference to API (Indicator: "CryptMsgClose"; File: "rufus-3.17.exe") Found reference to API (Indicator: "VirtualProtect"; File: "rufus-3.17.exe") Found reference to API (Indicator: "GetProcAddress"; File: "rufus-3.17.exe") Found reference to API (Indicator: "ExitProcess"; File: "rufus-3.17.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "rufus-3.17.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "rufus-3.17.exe") Found reference to API (Indicator: "GetDC"; File: "rufus-3.17.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "rufus-3.17.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "rufus-3.17.exe") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "CryptMsgClose"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp")2f:T1110,"rufus-3.17.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76150000 "rufus-3.17.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76150000 "rufus-3.17.exe" loaded module "KERNEL32" at base 75c20000 "rufus-3.17.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f90000 "rufus-3.17.exe" loaded module "KERNEL32.DLL" at base 75c20000 "rufus-3.17.exe" loaded module "ADVAPI32.DLL" at base 75ab0000 "rufus-3.17.exe" loaded module "COMCTL32.DLL" at base 75220000 "rufus-3.17.exe" loaded module "COMDLG32.DLL" at base 75620000 "rufus-3.17.exe" loaded module "CRYPT32.DLL" at base 77680000 "rufus-3.17.exe" loaded module "GDI32.DLL" at base 755f0000 "rufus-3.17.exe" loaded module "MSVCRT.DLL" at base 76e80000 "rufus-3.17.exe" loaded module "OLE32.DLL" at base 75910000 "rufus-3.17.exe" loaded module "SETUPAPI.DLL" at base 76a40000 "rufus-3.17.exe" loaded module "SHELL32.DLL" at base 763d0000 "rufus-3.17.exe" loaded module "SHLWAPI.DLL" at base 75a60000 "rufus-3.17.exe" loaded module "USER32.DLL" at base 770b0000 "rufus-3.17.exe" loaded module "VERSION.DLL" at base 75490000 "rufus-3.17.exe" loaded module "WINTRUST.DLL" at base 75fa0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75c20000 "rufus-3.17.exe" loaded module "RPCRT4.DLL" at base 756d0000 "rufus-3.17.exe" loaded module "SSPICLI.DLL" at base 74190000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 77680000 "rufus-3.17.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75c20000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73df0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 774e0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74ca0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\VDS_PS.DLL" at base 73db0000 "rufus-3.17.exe" loaded module "RICHED20" at base 734f0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 73410000 "rufus-3.17.exe" loaded module "COMCTL32" at base 75220000 "rufus-3.17.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760c0000 "rufus-3.17.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 770b0000 "rufus-3.17.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 770b0000 "rufus-3.17.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75ab0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75910000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75510000 "rufus-3.17.exe" loaded module "WININET" at base 74d70000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 73da0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSWOW64\OLEACC.DLL" at base 72f50000 "rufus-3.17.exe" loaded module "OLEAUT32.DLL" at base 77010000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 72ef0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72d10000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 72d00000 "rufus-3.17.exe" loaded module "DEVOBJ.DLL" at base 74770000 "rufus-3.17.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 76150000 "rufus-3.17.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72ce0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72ce0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74030000 "rufus-3.17.exe" loaded module "WINHTTP.DLL" at base 72c00000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72be0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72b80000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72af0000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSNATIVE\EN-US\SHELL32.DLL.MUI" at base 7400000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72a70000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72a00000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72a00000 "rufus-3.17.exe" loaded module "CRYPTNET.DLL" at base 72a00000 "rufus-3.17.exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 7297000030:T869,The input sample is signed with a certificate issued by "CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: E7:03:5B:CC:1C:18:77:1F:79:2F:90:86:6B:6C:1D:F8:DF:AA:BD:C0; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: E8:49:90:CB:9B:F8:E3:AB:0B:CA:E8:A6:49:CB:30:FE:4D:C4:D7:67; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: CA:77:88:C3:2D:A1:E4:B7:86:3A:4F:B5:7D:00:B5:5D:DA:CB:C7:F9; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=R3, O=Let's Encrypt, C=US" (SHA1: 4E:F1:FA:92:79:F1:C8:E9:D6:AC:A8:3E:D7:C7:53:85:16:9D:5B:29; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: A0:53:37:5B:FE:84:E8:B7:48:78:2C:7C:EE:15:82:7A:6A:F5:A4:05; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 9C:E9:A7:1C:CA:B3:B3:8A:74:78:1B:97:5F:1C:22:82:22:CF:7D:3B; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)31:T9c2,"rufus-3.17.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKCU\ZONEMAP\RANGES\"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") "rufus-3.17.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "")32:Tc6c,"rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "FF32ADA1-5A4B-583C-889E-A3C027B201F5"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: "FLAGS"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: "FLAGS"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: "FLAGS"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "FLAGS"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4"; Key: "FLAGS"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "RUFUS-3.17.EXE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "RUFUS-3.17.EXE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "")33:T4a3,"rufus-3.17.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\cfgmgr32.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\msasn1.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "rufus-3.17.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "rufus-3.17.exe" trying to touch file "C:\WINDOWS\SYSTEM32\SspiCli.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\sspicli.dll" "rufus-3.17.exe" trying to touch file "C:\WINDOWS\SYSTEM32\windows.storage.dll" "rufus-3.17.exe" trying to touch file "C:\Windows\SysWOW64\windows.storage.dll"34:T49d,"rufus-3.17.exe" touched file "C:\Windows\SysWOW64\GroupPolicy\gpt.ini" "rufus-3.17.exe" touched file "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" "rufus-3.17.exe" touched file "C:\Windows\System32\GroupPolicy\gpt.ini" "rufus-3.17.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "rufus-3.17.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "rufus-3.17.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "rufus-3.17.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido[1].ver" "rufus-3.17.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido.ps1[1].lzma" "rufus-3.17.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "rufus-3.17.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "rufus-3.17.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "rufus-3.17.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido[1].ver" "rufus-3.17.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\6LDIEKEG\Fido.ps1[1].lzma"35:T427,"rufus-3.17.exe" trying to access non-existent file "C:\rufus.app" "rufus-3.17.exe" trying to access non-existent file "C:\rufus.ini" "rufus-3.17.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui" "rufus-3.17.exe" trying to access non-existent file "C:\rufus.loc" "rufus-3.17.exe" trying to access non-existent file "C:\rufus-3.17.exe.Local\" "rufus-3.17.exe" trying to access non-existent file "C:\Windows\System32\GroupPolicy\User\Registry.pol" "rufus-3.17.exe" trying to access non-existent file "C:\Windows\SysWOW64\uxtheme.dll.Config" "rufus-3.17.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "rufus-3.17.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "rufus-3.17.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui" "rufus-3.17.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG" "rufus-3.17.exe" trying to access non-existent file "C:\rufus.com"36:T61b,Heuristic match: "\`.yE" Heuristic match: "Df.bY" Heuristic match: "`qp.N.sJ" Pattern match: "https://rufus.ie" Pattern match: "https://www.gnu.org/licenses/gpl-3.0.html" Pattern match: "https://github.com/pbatard/Fido/releases/download/v1.56/Fido.ps1.lzma" Heuristic match: "github.com" Heuristic match: "objects.githubusercontent.com" Heuristic match: "rufus.ie" Heuristic match: "/rufus.ie" Pattern match: "www.gnu.org/licenses/gpl-3.0.html" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "?!m.mm" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "http://schemas.microsoft.com/SMI/2019/WindowsSettings" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0@" Pattern match: "http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com0" Pattern match: "http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0" Pattern match: "https://secure.comodo.net/CPS0C" Pattern match: "crl.comodoca.com/COMODORSACodeSigningCA.crl0t" Pattern match: "crt.comodoca.com/COMODORSACodeSigningCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://s.symcd.com06" Pattern match: "http://s.symcb.com/universal-root.crl0" Pattern match: "https://github.com/pbatard" Heuristic match: "mailto:pete@akeo.ie"37:T634,Found URL "https://rufus.iecompanynameakeo" - Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found URL "https://www.gnu.org/licenses/gpl-3.0.htmloriginalfilenamerufus-3.17.exeproductnamerufusproductversion3.17.1846varfileinfotranslation6667555@iiio:::llljsssetttuuu7^^^" - Source: "00000000-00008128.00000000.166415.00B01000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0c<0:082http://crl.comodoca.com/comodorsacodesigningca.crl0th0f0>2http://crt.comodoca.com/comodorsacodesigningca.crt0$http://ocsp.comodoca.com0support@akeo.ie0(rk:g+zk^x6hbigreater" - Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$como" - Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found URL "https://github.com/pbatardrufus" - Source: "00000000-00008128.00000000.166415.03940000.00000004.mdmp")38:T4c6,"rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97B-E325-11CE-BFC1-08002BE10318}"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97B-E325-11CE-BFC1-08002BE10318}"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{71A27CDD-812A-11D0-BEC7-08002BE2092F}"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{71A27CDD-812A-11D0-BEC7-08002BE2092F}"; Key: "LOWERFILTERS")39:T5e7,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp, 00000000-00008128.00000000.166415.012F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp, 00000000-00008128.00000000.166415.012F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found string "\Device\HarddiskVolume3\rufus-3.17.exe" (Indicator: "\Device\"; Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found string "\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found string "\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008128.00000000.166415.00C20000.00000004.mdmp") Found string "uverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008128.00000000.166415.012F0000.00000004.mdmp") Found string "uverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008128.00000000.166415.012F0000.00000004.mdmp")3a:T899,"rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "")3b:T659,"rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000"; Key: "SERVICE") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "SERVICE") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "SERVICE") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "HARDWAREID") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "FRIENDLYNAME") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000"; Key: "HARDWAREID")3c:T77c,"rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000"; Key: "SERVICE") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000\FILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2B3EEDF9&0&000000"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "SERVICE") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000\FILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "LOWERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "SERVICE") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1\FILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "UPPERFILTERS") "rufus-3.17.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "LOWERFILTERS")3d:T5d6,"rufus-3.17.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{0E84597D-4714-484B-B052-E35C0916D987}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{0E84597D-4714-484B-B052-E35C0916D987}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "SUBMITSAMPLESCONSENT"; Value: "02000000") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{0E84597D-4714-484B-B052-E35C0916D987}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "DISABLEBLOCKATFIRSTSEEN"; Value: "01000000") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{85B0D3D4-3615-49BC-9C2C-12FF2213B6A6}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{85B0D3D4-3615-49BC-9C2C-12FF2213B6A6}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "SUBMITSAMPLESCONSENT"; Value: "02000000") "rufus-3.17.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{85B0D3D4-3615-49BC-9C2C-12FF2213B6A6}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\SPYNET"; Key: "DISABLEBLOCKATFIRSTSEEN"; Value: "01000000")3e:T406,"rufus-3.17.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{0E84597D-4714-484B-B052-E35C0916D987}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "ENABLESMARTSCREEN"; Value: "00000000") "rufus-3.17.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{0E84597D-4714-484B-B052-E35C0916D987}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "**DEL.SHELLSMARTSCREENLEVEL"; Value: "20000000") "rufus-3.17.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{85B0D3D4-3615-49BC-9C2C-12FF2213B6A6}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "ENABLESMARTSCREEN"; Value: "00000000") "rufus-3.17.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{85B0D3D4-3615-49BC-9C2C-12FF2213B6A6}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "**DEL.SHELLSMARTSCREENLEVEL"; Value: "20000000")3f:T449,"rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "rufus-3.17.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")40:T413,"rufus-3.17.exe" (Access type: "CREATE"; Path: "SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rufus-3.17.exe" (Access type: "CREATE"; Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rufus-3.17.exe" (Access type: "CREATE"; Path: "SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rufus-3.17.exe" (Access type: "CREATE"; Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "rufus-3.17.exe" (Access type: "CREATE"; Path: "SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "rufus-3.17.exe" (Access type: "CREATE"; Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "rufus-3.17.exe" (Access type: "CREATE"; Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST") "rufus-3.17.exe" (Access type: "CREATE"; Path: "SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST") "rufus-3.17.exe" (Access type: "CREATE"; Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")41:T6c7,Found malicious artifacts related to "185.199.111.153": ... URL: https://shmurdaca.github.io/suscess/ (AV positives: 1/92 scanned on 10/25/2021 18:18:36) URL: https://aniloli42.github.io/fb-clone/ (AV positives: 2/92 scanned on 10/25/2021 18:16:07) URL: https://ihsraham.github.io/FacebookLandingPage/ (AV positives: 1/92 scanned on 10/25/2021 18:11:05) URL: http://exchangepancakeswaps.github.io/nbnb (AV positives: 1/91 scanned on 10/25/2021 18:09:26) URL: https://the-bks.github.io/ (AV positives: 4/91 scanned on 10/25/2021 17:00:19) File SHA256: 4a27c932b600a0787e92ed7bf9dad28dc348cfd161f711710713e879e5e47f2f (Date: 10/25/2021 06:37:53) File SHA256: 01aadbab911fe125d04fc341cec6b657e00d4e76034c8c91a3dd83eea785bd48 (AV positives: 14/73 scanned on 10/23/2021 23:46:17) File SHA256: 3c8fca34b2568cfd9cf54809160468ee0e06c12e80f194519a3aea3b6ca166bd (AV positives: 2/72 scanned on 10/22/2021 00:57:41) File SHA256: 1186c3df614c063ebfcaa1f80444158add100578d5db503d5ca91e0e776b05d3 (AV positives: 17/72 scanned on 10/19/2021 11:16:03) File SHA256: 1b64e86acd91463705707c840bd02c36a6b5c36504d926f0d7f170c2505a4bc7 (AV positives: 2/74 scanned on 10/10/2021 14:00:45) File SHA256: 01cb7a7a70aa7f7d8da018ce9f4e16c51853d838d703ec8d5080d7ca7f0a4631 (AV positives: 1/72 scanned on 10/01/2021 21:18:13) File SHA256: 8251c1334de4cf196ad8f6c65676a42efcda960f8c172d91ebdf437b2eeb8494 (Date: 09/17/2021 01:19:35) File SHA256: e1f60815be01ed8a8ca1fceb308f091869caec3109990fae32378b25a578b0f1 (Date: 09/09/2021 22:53:45) File SHA256: 4e46ffb0876d898ffed0a7d4f2eb477b3e9a647dfa8052ab0bf3a5f896ed1cb8 (Date: 08/29/2021 17:56:09) File SHA256: b6e822aaaadfbb434566cdf80447c7d85b4ee0035d0b4a2a43886f32416da42c (Date: 08/28/2021 12:41:28)42:Tccb," If you don't have those in your app, Windows 10's GetVersionEx() --> DELIBERATELY reports the WRONG version... which brings us to --> tonight's spelling bee: "How do you spell 'spineless morons'?" --> The answer: "M-I-C-R-O-S-O-F-T; 'spineless morons'!" --> Windows 10 --> Windows 8.1 --> Windows 8 --> Windows 7 --> \" (Indicator: \"GetVersion\"; Source: \"00000000-00008128.00000000.166415.00B01000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rufus-3.17.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rufus-3.17.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"rufus-3.17.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUFUS-3.17.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.199.111.153:443\"\n \"140.82.113.4:443\"\n \"185.199.108.133:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: rufus-3.17.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"rufus-3.17.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008128.00000000.166415.00B01000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00008128.00000000.166415.00C20000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:8128:168:WilStaging_02\"\n \"Local\\SM0:8128:64:WilError_03\"\n \"SM0:8128:64:WilError_03\"\n \"Global/Rufus\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"rufus-3.17.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"z1 = https://github.com/pbatard/Fido/releases/download/v1.56/Fido.ps1.lzma\" (Indicator: \"github.com\")\n \"See https://github.com/pbatard\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"rufus-3.17.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 734F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rufus-3.17.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 774E0000\n \"rufus-3.17.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73DC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rufus-3.17.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 756D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"rufus-3.17.exe\" was detected as \"UPX\" and name: \"Packer\"\n \"rufus-3.17.exe\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"rufus-3.17.exe\" touched \"Virtual Disk Service Loader\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\")\n \"rufus-3.17.exe\" touched \"VDS ProxyStub\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TREATAS\")\n \"rufus-3.17.exe\" touched \"MSAA AccPropServices\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\\TREATAS\")\n \"rufus-3.17.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")\n \"rufus-3.17.exe\" touched \"Group Policy Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{EA502722-A23D-11D1-A7D3-0000F87571E3}\\TREATAS\")\n \"rufus-3.17.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\\TREATAS\")\n \"rufus-3.17.exe\" touched \"Network List Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\TREATAS\")\n \"rufus-3.17.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"rufus-3.17.exe\" has an executable section named \"UPX0\"\n \"rufus-3.17.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"rufus-3.17.exe\" has an writable section named \"UPX0\"\n \"rufus-3.17.exe\" has an writable section named \"UPX1\"\n \"rufus-3.17.exe\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"rufus-3.17.exe\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x68c015,lea\tedi, [esi - 0x28b015],push\tedi,mov\tebp, esp,lea\tebx, [esp - 0x3e80],xor\teax, eax,push\teax,cmp\tesp, ebx,jne\t0x7cfe88,inc\tesi,inc\tesi,push\tebx,push\t0x3cdfe7,push\tedi,add\tebx, 4,push\tebx,push\t0x143e4b,push\tesi,add\tebx, 4,push\tebx,push\teax,mov\tdword ptr [ebx], 0x20003,push\tebp,push\tedi,push\tesi,push\tebx,sub\tesp, 0x7c,mov\tedx, dword ptr [esp + 0x90],mov\tdword ptr [esp + 0x74], 0,mov\tbyte ptr [esp + 0x73], 0,mov\tebp, dword ptr [esp + 0x9c],lea\teax, [edx + 4],mov\tdword ptr [esp + 0x78], eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x144c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x28b000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x145000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"github.com\"\n \"objects.githubusercontent.com\"\n \"rufus.ie\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"rufus-3.17.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rufus-3.17.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rufus-3.17.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rufus-3.17.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00008128-00000C25-1598680749]\n Observed system executable string:\"%WINDIR%\\Sysnative\\en-US\\shell32.dll.mui\" [Source: 00000000-00008128-00000C25-1607308420]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"rufus-3.17.exe\" searching for window \"Rufus 3.17.1846\"\n \"rufus-3.17.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$30","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"rufus-3.17.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"rufus-3.17.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Ruf9EE2.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"rufus-3.17.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008128.00000000.166415.00B01000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rufus-3.17.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Ruf9EE2.tmp\" has type \"UTF-8 Unicode text with very long lines with CRLF line terminators\"- Location: [%TEMP%\\Ruf9EE2.tmp]- [targetUID: 00000000-00008128]\n \"Registry.pol\" has type \"data\"- Location: [%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol]- [targetUID: 00000000-00008128]\n \"rufus.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Rufus\\rufus.log]- [targetUID: 00000000-00008128]\n \"gpt.ini\" has type \"ASCII text with CRLF line terminators\"- Location: [%WINDIR%\\System32\\GroupPolicy\\gpt.ini]- [targetUID: 00000000-00008128]\n \"Fido_1_.ver\" has type \"ASCII text\"- [targetUID: 00000000-00008128]\n \"gpt.ini\" has type \"ASCII text with CRLF line terminators\"- Location: [%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini]- [targetUID: 00000000-00008128]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Ruf9EE2.tmp\" has type \"UTF-8 Unicode text with very long lines with CRLF line terminators\" - Location: [%TEMP%\\Ruf9EE2.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rufus-3.17.exe\" queries basic process information of the \"C:\\rufus-3.17.exe\" (UID: 8128)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rufus-3.17.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ruf9ee2.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM)\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Calls an API typically used to enumerate device information","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rufus-3.17.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"rufus-3.17.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ruf9ee2.tmp\"\n \"rufus-3.17.exe\" writes file \"c:\\windows\\syswow64\\grouppolicy\\gpt.ini\"\n \"rufus-3.17.exe\" writes file \"c:\\windows\\system32\\grouppolicy\\machine\\registry.pol\"\n \"rufus-3.17.exe\" writes file \"c:\\windows\\system32\\grouppolicy\\gpt.ini\"\n \"rufus-3.17.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\6ldiekeg\\fido[1].ver\"\n \"rufus-3.17.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\rufus\\rufus.log\"\n \"rufus-3.17.exe\" writes file \"%temp%\\ruf9ee2.tmp\"\n \"rufus-3.17.exe\" writes file \"%windir%\\syswow64\\grouppolicy\\gpt.ini\"\n \"rufus-3.17.exe\" writes file \"%windir%\\system32\\grouppolicy\\machine\\registry.pol\"\n \"rufus-3.17.exe\" writes file \"%windir%\\system32\\grouppolicy\\gpt.ini\"\n \"rufus-3.17.exe\" writes file \"%localappdata%\\microsoft\\windows\\inetcache\\ie\\6ldiekeg\\fido[1].ver\"\n \"rufus-3.17.exe\" writes file \"%localappdata%\\rufus\\rufus.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"rufus-3.17.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Rufus\\rufus.log\"\n \"rufus-3.17.exe\" writes a file \"%LOCALAPPDATA%\\Rufus\\rufus.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"rufus-3.17.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /Fido.ver\" - (UID: 00000000-00008128), \"rufus-3.17.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /pbatard/Fido/releases/download/v1.56/Fido.ps1.lzma\" - (UID: 00000000-00008128)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"rufus-3.17.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00008128)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"rufus-3.17.exe\" called \"InternetOpenA with parameter Rufus/3.17.1846 (Windows NT 11.0; WOW64)\" (UID: 00000000-00008128)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00008128-00000C26-1606266242\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00008128-00000C26-1606266319\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00008128-00000C26-1606266469\")\n Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00008128-00000C26-1606266543\")\n Found reference to API \"HttpQueryInfoA\" (Indicator: \"HttpQueryInfo\"; Source: \"00000000-00008128-00000C26-1606266618\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008128-00000C26-1606279658\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"objects.githubusercontent.com\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.32\"\n \"2.5.29.15\"\n \"2.5.29.31\"\n \"2.5.29.17\"\n \"2.5.4.6\"\n \"2.5.4.17\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.3\"\n \"2.5.4.9\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$37","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://rufus.ie\"\n Found HTTPS url \"https://www.gnu.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"rufus.ie\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"185.199.111.153\" on port \"443\"\n HTTPS traffic to \"140.82.113.4\" on port \"443\"\n HTTPS traffic to \"185.199.108.133\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLE927D31FB62903CBE80BD3BA77321]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE927D31FB62903CBE80BD3BA77321]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEF9A273D4D20717A5319CBAEC802F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE92E3640660631739D9FFE283428F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE92E3640660631739D9FFE283428F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68398\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68398\"\n \"cx\": \"88\"\n \"cy\": \"26\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68398\"\n \"cx\": \"133\"\n \"cy\": \"26\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68320\"\n \"cx\": \"88\"\n \"cy\": \"26\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845615\"\n \"cx\": \"17\"\n \"cy\": \"551\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33621748\"\n \"cx\": \"17\"\n \"cy\": \"30\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33621748\"\n \"cx\": \"460\"\n \"cy\": \"23\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33621748\"\n \"cx\": \"460\"\n \"cy\": \"25\"}\n \"rufus-3.17.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"50400034\"\n \"cx\": \"99\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rufus-3.17.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"rufus-3.17.exe\" called \"GetUserNameA\" (UID: 00000000-00008128)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00008128.00000000.166415.00C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"rufus-3.17.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00008128.00000000.166415.00B01000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"rufus-3.17.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008128.00000000.166415.00B01000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$39","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format Options\" (Indicator: \"format \"; Source: \"00000000-00008128-00000455-20416387438\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"rufus-3.17.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008128.00000000.166415.00B01000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"rufus-3.17.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008128.00000000.166415.00B01000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rufus-3.17.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: rufus-3.17.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"rufus.log\" - Location: [%LOCALAPPDATA%\\Rufus\\rufus.log]- [targetUID: 00000000-00008128]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"rufus-3.17.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rufus-3.17.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.99980679471","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"rufus-3.17.exe\" has a section named \"UPX0\"\n \"rufus-3.17.exe\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"rufus-3.17.exe\" reads file \"C:\\Windows\\SysWOW64\\GroupPolicy\\gpt.ini\"\n \"rufus-3.17.exe\" reads file \"C:\\Windows\\System32\\GroupPolicy\\gpt.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.199.111.153 on port 443 is sent without HTTP header\n TCP traffic to 140.82.113.4 on port 443 is sent without HTTP header\n TCP traffic to 185.199.108.133 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"rufus-3.17.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"rufus-3.17.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"rufus-3.17.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido[1].ver\" with delete access\n \"rufus-3.17.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido.ps1[1].lzma\" with delete access\n \"rufus-3.17.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Ruf9EE2.tmp\" with delete access\n \"rufus-3.17.exe\" opened \"C:\\rufus.com\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"rufus-3.17.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"rufus-3.17.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n LoadLibraryA\n ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"rufus-3.17.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads VM specific registry key","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the registry for VMWare specific artifacts","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-56","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender via registry","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-77","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"malicious","category":"System Security","name":"Modifies Group policy settings registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1484.001","relevance":5,"id":"registry-148","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"level":"malicious","category":"System Security","name":"Modifies Windows Auto-Updates feature","description":"\"rufus-3.17.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{0E84597D-4714-484B-B052-E35C0916D987}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")\n \"rufus-3.17.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{85B0D3D4-3615-49BC-9C2C-12FF2213B6A6}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-24","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/35 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/68 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"rufus.ie\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"rufus-3.17.exe\" created file \"%TEMP%\\Ruf892C.tmp\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"rufus-3.17.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"rufus-3.17.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"rufus-3.17.exe\" at 00000000-00002772-00000033-3134217","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"t MSG_265 \"VMWare disk detection\"\" (Indicator: \"vmware\")\n \"t MSG_265 \" VMWare\"\" (Indicator: \"vmware\")\n \"t MSG_265 \" VMWare \"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare \"\" (Indicator: \"vmware\")\n \"t MSG_265 \"Otkrivanje VMware diska\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare detekce disk\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare disk detektering\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare-schijfdetectie\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare-levyn havaitseminen\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"Dtection de disque VMWare\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMware-Laufwerkserkennung\"\" (Indicator: \"vmware\")\n \"t MSG_265 \" VMWare\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMware lemez szlelse\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"Deteksi VMWare disk\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"Rilevamento disco VMWare\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare \"\" (Indicator: \"vmware\")\n \"t MSG_265 \"Noteikts VMWare disks\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare disko aptikimas\"\" (Indicator: \"vmware\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"rufus-3.17.exe\" read file \"%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini\"\n \"rufus-3.17.exe\" read file \"%WINDIR%\\System32\\GroupPolicy\\GPT.INI\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"rufus-3.17.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"rufus-3.17.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"rufus-3.17.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"rufus-3.17.exe\" wrote bytes \"7d07017781edff76ae86fe76c6e0fd76effd00772d16ff7660140177478dfe76a8e2fd766089fe7600000000ad3722758b2d2275b641227500000000\" to virtual address \"0x73291000\" (part of module \"WSHTCPIP.DLL\")\n \"rufus-3.17.exe\" wrote bytes \"711125027a3b2402ab8b02007f950200fc8c0200729602006cc805001ecd21027d262102\" to virtual address \"0x74DE07E4\" (part of module \"USER32.DLL\")\n \"rufus-3.17.exe\" wrote bytes \"0efc007781edff76ae86fe76c6e0fd76effd00772d16ff76c0fcfc76da8f077760140177478dfe76a8e2fd766089fe7600000000ad3722758b2d2275b641227500000000\" to virtual address \"0x732A1000\" (part of module \"WSHIP6.DLL\")\n \"rufus-3.17.exe\" wrote bytes \"c0dffd761cf9fc76ccf8fc760d64fe7600000000c0118c7400000000fc3e8c7400000000e0138c74000000009457fa7525e0fd76c6e0fd7600000000bc6af97500000000cf318c74000000009319fa75000000002c328c7400000000\" to virtual address \"0x74AC1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$41","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$42","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\rufus-3.17.exe\" marked \"%TEMP%\\RufBA4E.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"rufus-3.17.exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"RUFUS-v3.17p_Portb-OFIC_.exe\" queries volume information of \"C:\\share\" at 00000000-00002592-00000049-30154779","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"\"RUFUS-v3.17p_Portb-OFIC_.exe\" trying to touch file \"%PROGRAMFILES%\\(x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll\"\n \"RUFUS-v3.17p_Portb-OFIC_.exe\" trying to touch file \"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL\"\n \"RUFUS-v3.17p_Portb-OFIC_.exe\" trying to touch file \"%PROGRAMFILES%\\(x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF\"\n \"RUFUS-v3.17p_Portb-OFIC_.exe\" trying to touch file \"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender Anti Spyware","description":"\"RUFUS-v3.17p_Portb-OFIC_.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{6E661D28-8797-4767-B51E-06A284B1FD6F}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")\n \"RUFUS-v3.17p_Portb-OFIC_.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{74E94846-90B9-4AD2-9ECB-CCC85F9F63ED}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-76","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Reads VM specific registry key"},{"detail":"Reads the registry for VMWare specific artifacts"},{"detail":"Tries to disable Windows defender via registry"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":55,"imported_dlls_count":208,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":48,"files_deleted_count":0,"registry_keys_created_count":27,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":29,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","agent","kryptik","stealer"],"sample_flags":["Network Traffic","Extracted Files","User Comment","TOR analysis","Sample not shared"],"sandbox_reports":[{"id":"66632436358414188705b906","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD","USA"],"submit_name":"rufus-3.17.exe","analysis_start_time":"2024-06-07T15:16:22+00:00","indicators_count":{"informative":100,"suspicious":39,"malicious":5},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"659b617953f8a8161203ac87","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD","USA"],"submit_name":"rufus-3.17.exe","analysis_start_time":"2024-01-08T02:44:10+00:00","indicators_count":{"informative":101,"suspicious":38,"malicious":5},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"6377ded370eb521f8149ab44","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD"],"submit_name":"RUFUS - v3.17p (Portb-OFIC) .exe","analysis_start_time":"2022-11-18T19:36:52+00:00","indicators_count":{"informative":32,"suspicious":43,"malicious":2},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"6305b195bcee2838560a9eb1","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD"],"submit_name":"rufus-3.17.exe","analysis_start_time":"2022-08-24T05:22:59+00:00","indicators_count":{"informative":24,"suspicious":30,"malicious":1},"tags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"61d97732cea17879903b9131","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD"],"submit_name":"rufus-3.17.exe","analysis_start_time":"2022-01-08T11:36:23+00:00","indicators_count":{"informative":21,"suspicious":31,"malicious":2},"tags":["Network Traffic","Extracted Files","Sample not shared","User Comment"],"is_in_unified_schema":true},{"id":"61d59b909d933d385a3eb31e","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"no specific threat","submit_name":"rufus-3.17.exe","analysis_start_time":"2022-01-05T13:22:27+00:00","indicators_count":{"informative":3,"suspicious":1,"malicious":0},"tags":["Sample not shared","User Comment"],"is_in_unified_schema":false},{"id":"61d59b40e906bc075f7138da","environment_id":300,"environment_description":"Linux (Ubuntu 16.04, 64 bit)","state":"ERROR","error_type":"The requested environment ID \"300\" and file type \"exe\" have no available execution environment","verdict":"undetected","submit_name":"rufus-3.17.exe","analysis_start_time":"2022-01-05T13:21:04+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"6177765ef96a6b6b4c2c3050","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD"],"submit_name":"rufus-3.17p.exe","analysis_start_time":"2021-10-26T03:30:43+00:00","indicators_count":{"informative":20,"suspicious":30,"malicious":2},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"6176f9fd0a62fc158a42b455","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"rufus-3.17.exe","analysis_start_time":"2021-10-25T18:39:57+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"6176f9dc0536b966a003fd6d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD"],"submit_name":"rufus-3.17.exe","analysis_start_time":"2021-10-25T18:39:33+00:00","indicators_count":{"informative":20,"suspicious":30,"malicious":1},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.199.111.153","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"address":"140.82.113.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"address":"185.199.108.133","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"address":"185.199.110.153","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]}],"dns_resolutions":[{"domain":"github.com","address":"140.82.113.4","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_creation_date":"2007-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"domain":"objects.githubusercontent.com","address":"185.199.108.133","ttl":2564,"country":"Netherlands","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1411.AWSDNS-48.ORG","registrar_creation_date":"2014-02-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"domain":"rufus.ie","address":"185.199.111.153","ttl":3151,"country":"Netherlands","registrar_name_servers":"ns1.blacknight.com","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}],"processes":[{"pid":8128,"ppid":0,"name":"rufus-3.17.exe","command_line":"","sha256":"6d362897059df29d9674112a43e68dbc549ba4c25e7036dd9fae7c92bfafda02","normalized_path":"C:\\rufus-3.17.exe","uid":"00000000-00008128","icon":"$44"}],"all_imported_dlls":["kernel32.dll","sechost.dll","SHCore.dll","gdi32.dll","riched20.dll","gpedit.dll","oleacc.dll","iertutil.dll","bcryptprimitives.dll","ntdsapi.dll","ExplorerFrame.dll","IPHLPAPI.DLL","ncrypt.dll","ncryptsslp.dll","Wldap32.dll","windows.storage.dll","usp10.dll","gpapi.dll","IconCodecService.dll","dnsapi.dll","dpapi.dll","version.dll","cfgmgr32.dll","VxSSL32.dll","oleaut32.dll","kernel.appcore.dll","logoncli.dll","wininet.dll","urlmon.dll","shlwapi.dll","ole32.dll","sspicli.dll","profapi.dll","bcrypt.dll","clbcatq.dll","msls31.dll","ntasn1.dll","msvcp_win.dll","comctl32.dll","ws2_32.dll","WinTypes.dll","CoreUIComponents.dll","TextShaping.dll","winnsi.dll","schannel.dll","wow64con.dll","advapi32.dll","msvcrt.dll","ucrtbase.dll","fltLib.dll","uxtheme.dll","activeds.dll","CoreMessaging.dll","wow64cpu.dll","WindowsCodecs.dll","ntdll.dll","wow64.dll","user32.dll","win32u.dll","crypt32.dll","winhttp.dll","cryptnet.dll","KernelBase.dll","setupapi.dll","msasn1.dll","cryptsp.dll","dsuiext.dll","adsldpc.dll","netprofm.dll","devobj.dll","gdi32full.dll","wintrust.dll","authz.dll","mswsock.dll","mpr.dll","wow64win.dll","rpcrt4.dll","shell32.dll","imm32.dll","msctf.dll","comdlg32.dll","combase.dll","imagehlp.dll","rsaenh.dll","vds_ps.dll","framedynos.dll","FWPUCLNT.DLL","dsrole.dll","npmproxy.dll","wow64base.dll","TextInputFramework.dll","OnDemandConnRouteHelper.dll","srvcli.dll","netutils.dll","dssec.dll","cryptbase.dll","nsi.dll","rasadhlp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","wshqos.dll","SensApi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","RpcRtRemote.dll","oleaccrc.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","secur32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","dui70.dll","dhcpcsvc.dll","dwmapi.dll","imageres.dll","credssp.dll","normaliz.dll","duser.dll","WSHTCPIP.DLL","atl.dll","nlaapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wkscli.dll","webio.dll","wtsapi32.dll","dfscli.dll","wship6.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","dhcpcsvc6.dll","slc.dll","lpk.dll","samcli.dll","netapi32.dll","rpcss.dll","DevDispItemProvider.dll","msvcp90.dll","browcli.dll","propsys.dll","WMVCORE.DLL","WMASF.DLL","powrprof.dll","rmclient.dll","dlnashext.dll","Windows.StateRepositoryPS.dll","MMDevAPI.dll","fdProxy.dll","cscapi.dll","edputil.dll","twinapi.appcore.dll","OneCoreUAPCommonProxyStub.dll","davhlpr.dll","GROOVEEX.DLL","msvcr90.dll","dxgi.dll","msIso.dll","winnlsres.dll","BCP47Langs.dll","globinputhost.dll","networkitemfactory.dll","dtsh.dll","winmm.dll","FirewallAPI.dll","PlayToDevice.dll","xmllite.dll","fwbase.dll","mskeyprotect.dll","davclnt.dll","mfperfhelper.dll","msvcp110_win.dll","UIAutomationCore.dll","shellstyle.dll","RTWorkQ.dll","aepic.dll","winmmbase.dll","GdiPlus.dll","d3d11.dll","dcomp.dll","fundisc.dll","WcnApi.dll","DataExchange.dll","OneCoreCommonProxyStub.dll","apphelp.dll","Windows.Globalization.dll","coml2.dll","fwpolicyiomgr.dll","tiptsf.dll","mfplat.dll","atlthunk.dll","wpdshext.dll","ntmarta.dll","linkinfo.dll","twinapi.dll","networkexplorer.dll","Windows.Storage.Search.dll","drprov.dll","winsta.dll","audiodev.dll","ATL90.dll","StructuredQuery.dll","thumbcache.dll","fdWCN.dll","fdWNet.dll","policymanager.dll","PortableDeviceApi.dll","ntshrui.dll","cldapi.dll","sxs.dll","ntlanman.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"rufus.log","sha256":"a46db59c2ac42d0bc6befcd78d2d2dcb1b97770a798883233a963eab5c8cf4b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Ruf9EE2.tmp","sha256":"b6dc3c02b1a6098a12bf23632b1c897666e3b41140aeee9d6075d2c4e5735659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"name":"gpt.ini","sha256":"77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Registry.pol","sha256":"418bea8e0794e63b3cf824d7ea01eef1a722b5459348b5d814d8fdac504a7626","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Fido_1_.ver","sha256":"0be22717c127b870cd0837c64aee527ef2d64f22483c0617073b03fd845615ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"db02f045b18e7c4efbdee4b72f179dfb9a82452a716e87990e32e302de7559c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Ruf892C.tmp","sha256":"b6dc3c02b1a6098a12bf23632b1c897666e3b41140aeee9d6075d2c4e5735659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"name":"GPT.INI","sha256":"c94d19972596583b944366b291a1d48b357e88835e7218e0f0d184ac1e29f05a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"name":"RufBA4E.tmp","sha256":"b6dc3c02b1a6098a12bf23632b1c897666e3b41140aeee9d6075d2c4e5735659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"name":"Ruf6807.tmp","sha256":"b6dc3c02b1a6098a12bf23632b1c897666e3b41140aeee9d6075d2c4e5735659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"name":"103621DE9CD5414CC2538780B4B75751","sha256":"e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Ruf5D36.tmp","sha256":"b6dc3c02b1a6098a12bf23632b1c897666e3b41140aeee9d6075d2c4e5735659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"rufus.ini","sha256":"92e2a7e2a9b7782fec6913d9d7052f81e35ec555ac9dccaec76784576dd9bae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"rufus.ini~","sha256":"92e2a7e2a9b7782fec6913d9d7052f81e35ec555ac9dccaec76784576dd9bae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]}],"files_written":[{"path":"%TEMP%\\Ruf9EE2.tmp","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"path":"%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\gpt.ini","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido[1].ver","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\Fido.ps1[1].lzma","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"path":"%LOCALAPPDATA%\\Rufus\\rufus.log","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"C:\\rufus.ini","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"C:\\rufus-3.17.exe","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\gpedit.dll.mui","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\User","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\User\\Registry.pol","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\GPT.INI","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\comdlg32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\103621DE9CD5414CC2538780B4B75751","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"path":"C:\\Rufus\\rufus.log","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"key":"AKEO CONSULTING\\RUFUS\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"RUFUS\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"AKEO CONSULTING\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"SOFTWARE\\AKEO CONSULTING\\RUFUS\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{B6248A6C-0AA3-4708-B5BF-3FF81E5820A2}MACHINE\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{B6248A6C-0AA3-4708-B5BF-3FF81E5820A2}USER\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"POLICIES\\","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"key":"HKCU\\SOFTWARE\\AKEO CONSULTING\\RUFUS\\","sources":[{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"key":"HKCU\\SOFTWARE\\AKEO CONSULTING\\","sources":[{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\EPOCH\\","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:8128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"name":"Local\\SM0:8128:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"name":"SM0:8128:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"}]},{"name":"Global/Rufus","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"66632436358414188705b906"},{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global/Rufus","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6176f9dc0536b966a003fd6d"},{"report_type":"sandbox","report_id":"6305b195bcee2838560a9eb1"},{"report_type":"sandbox","report_id":"61d97732cea17879903b9131"},{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Local\\SM0:2592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Local\\Shell.CMruPidlList","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Local\\SM0:2592:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2592:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2592:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Shell.CMruPidlList","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6377ded370eb521f8149ab44"}]}]}},"report_ids":{"sandbox_job_ids":["6176f9dc0536b966a003fd6d","66632436358414188705b906","6377ded370eb521f8149ab44","6305b195bcee2838560a9eb1","61d97732cea17879903b9131"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 6d362897059d… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 6d362897059d…. Threat score 0/100. 0/27 AV engines flagged this file. 8 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6d362897059df29d9674112a43e68dbc549ba4c25e7036dd9fae7c92bfafda02"}],["$","meta","4",{"property":"og:title","content":"Sample 6d362897059d… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 6d362897059d…. Threat score 0/100. 0/27 AV engines flagged this file. 8 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6d362897059df29d9674112a43e68dbc549ba4c25e7036dd9fae7c92bfafda02"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 6d362897059d… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 6d362897059d…. Threat score 0/100. 0/27 AV engines flagged this file. 8 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]