21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T411,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample ec3136b053bd… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample ec3136b053bd…. Threat score 0/100. 0/23 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb","keywords":["Clean","malware analysis","sandbox report","threat intelligence","ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb"],"about":{"@type":"SoftwareApplication","name":"rufus-3.13p.exe","applicationCategory":["peexe","executable"],"identifier":"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":23},"behavioralIndicators":{"malicious":8,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3cAAAAAAAAAAAAAAAAHd3d3cAAAAAAAAAAAAAAAd4d3+HcAAAAAAAAAAAAAAHd4iI+HcAAAAAAAAAAAAAB4iP+HiHcAAAAAAAAAAAAAiIj/d4+HAABAAAAAAAAAAAiHeIiI92cARgAAAAAAAAAAh4iIiHd3cAYAAAAAAAAAAAeIiHd3d3cAYAAAAAAAAAAAd3d3d3d3cAYAAAAAAAAAd3d3d3d3d3cAYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3cEYAAAAAAAAHd3d3d3d3d3YEYAAAAAAAAHd3d3d3iId3YEYAAAAAAAAHd3d3iIiId3YEYAAAAAAAAHd3iIiIiId3YGAAAAAAAAAHdHiIiIiId3YGAAAAAAAAAAdniIiIiId3YGAAAAAAAAAAd3iIiIiHd3YEAAAAAAAAAAd3iIiHcHd3YAAAAAAAAAAAd3iHcHd3d3QAAAAAAAAAAAd3AHd3d3d3AAAAAAAAAAAAd3d3d3d3d3AAAAAAAAAAAAd3d3d3d3dgAAAAAAAAAAAAd3d3d3ZkAAAAAAAAAAAAAAd2ZAAEAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////v////B////AP///gB///4AP//+AAH//gAA//8AAH//gAB//8AAP//AAB//gAAP/4AAB//AAAP/4AAB//AAAP/4AAB//AAAf/4AAD//gAAf/8AAD//gAAf/8AAH//gAB//8AAf//gAH//8AD///gD///8H///////////w==23:T4ba,"rufus-3.13.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\imageres.dll" "rufus-3.13.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\en-US\shell32.dll.mui" "rufus-3.13.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "rufus-3.13.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "rufus-3.13.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\wshqos.dll" "rufus-3.13.exe" touched file "C:\Windows\System32\GroupPolicy\GPT.INI" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\en-US\gpedit.dll.mui" "rufus-3.13.exe" touched file "C:\Windows\SysWOW64\GroupPolicy\gpt.ini" "rufus-3.13.exe" touched file "C:\Windows\System32\GroupPolicy\Machine" "rufus-3.13.exe" touched file "C:\Windows\System32\GroupPolicy\User"24:T87a,Found malicious artifacts related to "185.199.108.153": ... URL: http://185.199.108.153/ (AV positives: 1/87 scanned on 05/11/2021 04:57:04) URL: http://azizaissamerazga.github.io/azizaissamerazga.github.com (AV positives: 5/87 scanned on 05/11/2021 04:38:29) URL: http://juan24-git.github.io/lov (AV positives: 3/87 scanned on 05/11/2021 04:13:52) URL: http://chfotm.github.io/netflix (AV positives: 9/87 scanned on 05/11/2021 04:07:42) URL: http://telectronicmb.github.io/telectronicmb.github.com (AV positives: 5/87 scanned on 05/11/2021 04:03:58) File SHA256: 46ae4943c52fbb3b828f2a9470700945b1aacff3f102318be7c553aafc9793ab (Date: 05/02/2021 02:15:38) File SHA256: 196f6f338e7e153f46204f6ec209f6aa8dc79ed05e75ab8ab5d74b6fd5db08cd (AV positives: 1/74 scanned on 05/01/2021 21:26:20) File SHA256: c8de802ca64590260b6418422f7d8b813ffc4701ddf16e314f0a35d1e3b5afef (AV positives: 1/73 scanned on 04/27/2021 13:44:49) File SHA256: 6baf7525ea7fa98bf2d0422b6a207f4b5babf04a7c4c935e1249dae35ffb807e (AV positives: 27/75 scanned on 04/25/2021 13:08:36) File SHA256: c5faf8c41d3dac320c6f55c78026ad206c82d9097b7713b65a31494a18f06e07 (Date: 04/21/2021 22:43:06) File SHA256: 8b311c55be157e2d5ff0db9b74fffbc61798cdec49f0490a91527a6dc9b05fcd (AV positives: 2/74 scanned on 04/19/2021 10:05:38) File SHA256: b24b6ab226004bb54dc82a0a62d6f2da1bdfed3aa9d01e2f8a1679ae2df12672 (Date: 04/19/2021 14:23:29) File SHA256: 94b36ade02a292033d6e2601480aab0fbcf59a31439ba6c314b344a0ccae517f (AV positives: 2/73 scanned on 04/17/2021 01:07:30) File SHA256: b77a0d47d7ea270bc244de8fac03443a55aea51b (Date: 04/11/2021 01:37:45) File SHA256: 59dcddeeedf15bc408bd13d6be237d01ae9f0be49adbb7bb5f3a87d544888969 (Date: 04/11/2021 01:37:45) File SHA256: e851ffa805a18022d0e36457ba558147 (Date: 04/11/2021 01:37:45) File SHA256: edeba249b43258151912c6b22aae89e5f461a6d6b91684ed5406be684dc653c2 (Date: 04/10/2021 09:32:42) File SHA256: 67f84502be0013b7cfb3ee4a3fc404df78d1693581bab352f0d59711521b544d (Date: 04/09/2021 20:08:08) File SHA256: 97a825270d730b0a0113d55d00dce2e083dbc56b (Date: 11/23/2020 23:26:36) File SHA256: 167a50460d155807e2051828a2cf9c5f (Date: 11/23/2020 23:26:36)25:T92a,"rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "rufus-3.13.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")26:T80f,Found reference to API (Indicator: "FreeSid"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "GetOpenFileNameW"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "CryptMsgClose"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "ExitProcess"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "GetProcAddress"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "VirtualProtect"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "CoCreateGuid"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "ShellExecuteA"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "GetDC"; File: "rufus-3.13p.bin") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "CryptMsgClose"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007324.00000000.68895.01559000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00007324.00000000.68895.7F860000.00000002.mdmp")27:Tc1e,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "RUFUS-3.13P.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "RUFUS-3.13P.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "")28:T9f5,".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\ZONEMAP\RANGES\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER"; Key: ""; Value: "")29:T45a,".exe" called "FindResourceA" with parameter "500" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "101" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "103" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "106" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "125" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "126" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "401" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "403" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "121" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "122" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "123" - (UID: 00000000-00007324) ".exe" called "FindResourceA" with parameter "124" - (UID: 00000000-00007324)2a:T6d5,"\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007324.00000000.68895.01200000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007324.00000000.68895.03610000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007324.00000000.68895.7F860000.00000002.mdmp2b:Td04,Found string "t MSG_051 "Mrittmtn virhe alustaessa."" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_065 "Virhe kirjoittaessa."" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_168 "Yrit naamioida ensimminen boottaava USB-asema (yleens 0x80) eri asemaksi.\nTmn tulisi olla tarpeellista vain asennettaessa Windows XP:t kun levyj on useampia."" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_186 "Rufus ei asenna tai aja taustapalveluja siksi pivitystarkistukset suoritetaan vain psovelluksen ollessa kynniss.\\line\nInternetyhteys toki vaaditaan pivityksi tarkistettaessa."" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_255 "NoDriveTypeAutorun poistetaan suljettaessa"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDD_NEW_VERSION "Procurar atualizaes do Rufus"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDC_MORE_INFO "Mais informaes"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDD_UPDATE_POLICY "Configuraes e poltica de atualizao"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDS_UPDATE_SETTINGS_GRP "Configuraes"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDS_UPDATE_FREQUENCY_TXT "Procurar atualizaes"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_005 "Permitir que o Rufus procure atualizaes na Internet?"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_012 "%s\nMais informaes disponveis em:\n%s"" (Indicator: "aes"; File: "Ruf5FB6.tmp") file/memory contains long string with (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_180 "Se voc optar por permitir que este programa verifique se h atualizaes do aplicativo voc concorda que as seguintes informaes possam ser coletadas em nosso(s) servidor(es):"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_184 "A fim de gerar estatsticas de uso privadas as informaes recolhidas podem ser retidas \\b por at um ano\\b0 . A menos que assim seja requerido por lei no ser transmitida nenhuma dessas informaes a terceiros."" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_186 "O Rufus no instala nem executa servios em segundo plano. Portanto as verificaes de atualizao s se realizam quando o aplicativo principal est em execuo.\\line\nO acesso Internet claro necessrio ao verificar atualizaes."" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_243 "Procurando atualizaes do Rufus..."" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_244 "Atualizaes: No possvel conectar-se Internet"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_245 "Atualizaes: No foi possvel acessar dados da verso"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_252 "Verificaes de tamanho"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_301 "Exibir configuraes do programa"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t MSG_302 "Exibir informaes sobre este programa"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDD_ABOUTBOX "Informaes do Produto"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDD_NEW_VERSION "Procurar atualizaes de Rufus"" (Indicator: "aes"; File: "Ruf5FB6.tmp") Found string "t IDD_UPDATE_POLICY "Configurao e poltica das atualizaes"" (Indicator: "aes"; File: "Ruf5FB6.tmp")2c:Td20b,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter AttachConsole (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DefineDosDeviceA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DeleteVolumeMountPointA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter EnumUILanguagesW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FindFirstVolumeA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FindNextVolumeA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FindVolumeClose (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSystemDefaultLangID (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetVolumeNameForVolumeMountPointA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetVolumePathNameA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter K32GetModuleFileNameExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter K32GetProcessImageFileNameW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter QueryDosDeviceA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetDllDirectoryA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetThreadAffinityMask (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetVolumeLabelA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetVolumeMountPointA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter VerifyVersionInfoA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ConvertStringSidToSidA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptVerifySignatureW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RegDeleteKeyA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetSecurityDescriptorOwner (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ImageList_ReplaceIcon (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CommDlgExtendedError (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetOpenFileNameW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSaveFileNameW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CertGetNameStringA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptDecodeObjectEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptMsgOpenToDecode (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptMsgUpdate (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreatePen (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter EnumFontFamiliesExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetTextFaceW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LineTo (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MoveToEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter Rectangle (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetDCPenColor (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __getmainargs (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __initenv (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __lconv_init (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __p___argv (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __p__acmdln (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __p__commode (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __set_app_type (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _access (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _aligned_free (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _aligned_malloc (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _assert (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _atoi64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _chdir (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _close (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _filelengthi64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _fileno (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _flushall (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _fstati64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _iob (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _lseeki64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _mkdir (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _open (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _open_osfhandle (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _read (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _setjmp3 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _snprintf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _snprintf_s (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _snwprintf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _splitpath (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _stati64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _strcmpi (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _strnicmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _strtoi64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _tzset (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _vscprintf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _vsnprintf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _waccess (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wchdir (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wcsnicmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wfopen_s (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wmkdir (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _write (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wsopen_s (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wstat64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wstati64 (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter _wunlink (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter atoi (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter atol (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter clearerr (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter feof (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ferror (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fflush (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fgetpos (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fgets (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fgetws (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fputs (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fputws (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter free (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter freopen (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fseek (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fsetpos (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ftell (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter fwprintf_s (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter getc (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter getenv (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter gmtime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter isalpha (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter islower (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter isspace (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter isupper (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter rename (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter mktime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter localtime (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter longjmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter printf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter putchar (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter puts (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter setlocale (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter setvbuf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strcat (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strncat (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strspn (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strtok (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strtol (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter strtoul (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter time (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter toupper (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcscpy (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcsncat (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcsncmp (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcsncpy (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcsspn (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcsstr (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wcstombs (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Get_Child (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Get_DevNode_Status (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Get_Device_IDA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Get_Device_ID_ListA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Get_Device_ID_List_SizeA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Get_Parent (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Get_Sibling (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CM_Locate_DevNodeA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiChangeState (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInfo (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInstanceIdA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetupDiSetClassInstallParamsW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DragQueryFileW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHBrowseForFolderW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHChangeNotifyDeregister (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHChangeNotifyRegister (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHCreateDirectoryExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHFileOperationW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SHSimpleIDListFromPath (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter PathFileExistsA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter PathFileExistsW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter PathGetDriveNumberW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter wnsprintfW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CharUpperBuffW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CheckDlgButton (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CopyRect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateDialogIndirectParamW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateIconIndirect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreatePopupMenu (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DestroyMenu (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DialogBoxIndirectParamW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DrawIconEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DrawTextExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FindWindowExA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter FlashWindowEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetDlgItemTextW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InflateRect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InsertMenuW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter IsDlgButtonChecked (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MapDialogRect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MessageBeep (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MessageBoxExW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter PostQuitMessage (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SendDlgItemMessageA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetDlgItemTextA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetDlgItemTextW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetProcessDefaultLayout (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter TrackPopupMenuEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter UnhookWinEvent (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter WinVerifyTrustEx (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter __wgetmainargs (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter NtOpenProcessToken (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter NtAdjustPrivilegesToken (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetGetConnectedState (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00007324) ".exe" called "GetProcAddress" with a parameter InternetGetLastResponseInfoA (UID: 00000000-00007324)2d:T18ae,Found reference to API "t MSG_176 " :\\line Krasimir Nevenov \\line Kaloyan Nikolov "" (Indicator: "@yahoo."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 " :\\line Krasimir Nevenov \\line Kaloyan Nikolov "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 ": \\line Chocobo1 "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Preveo:\\line Dario Komar \\line Saa Vujani "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Preveo:\\line Dario Komar \\line Saa Vujani "" (Indicator: "@hotmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Dansk oversttelse:\\line Jens Hansen \\line Bo Riis \\line Andrea Wood "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Dansk oversttelse:\\line Jens Hansen \\line Bo Riis \\line Andrea Wood "" (Indicator: "@live."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Nederlandse vertaling:\\line Roberto Pino \\line Thomas De Rocker "" (Indicator: "@outlook."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 " :\\line Konstantinos Margaritis \\line Nikolaos Margaritis \\line Alex F. "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 " :\\line Konstantinos Margaritis \\line Nikolaos Margaritis \\line Alex F. "" (Indicator: "@outlook."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Magyar fordts:\\line Viszokai Gyrgy \\line Csizmadia Gbor "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Magyar fordts:\\line Viszokai Gyrgy \\line Csizmadia Gbor "" (Indicator: "@hotmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Terjemahan Bahasa Indonesia: \\line Abe Akatsuki\\line Arif Budiman "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 ": \\line: Tiryoh "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 ": \\line: Tiryoh "" (Indicator: "@live."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 " : - "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Lietuvikas vertimas: Gintaras Venslovas "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Terjemahan Bahasa Malaysia:\\line\n Muhammad Aman \\line\n VGPlayer \\line\n Mohamad Ikhwan bin Kori "" (Indicator: "@yahoo."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Terjemahan Bahasa Malaysia:\\line\n Muhammad Aman \\line\n VGPlayer \\line\n Mohamad Ikhwan bin Kori "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Norsk oversettelse:\\line JED \\line Thorbjrn Bruary \\line Jakub Zieciak "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Norsk oversettelse:\\line JED \\line Thorbjrn Bruary \\line Jakub Zieciak "" (Indicator: "@outlook."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 " : mailto:s.zia.azimi@gmail.com"" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Polskie tumaczenie:\\line Piotr Halama \\line Poprawki: Krzysztof J. Szklarski\\line Jakub Zieciak "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Tradutores: Tiago Rinaldi \\line\\tab Chateaubriand Vieira Moura "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Traducere n romn de Grlea Alexandru "" (Indicator: "@yahoo."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Preveo:\\line Ivan Strugar \\line Aleksandar Predi \\line Milo Ljubii "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Traduccin al espaol:\\tab Jos Pineda \\line\n\\tab\\tab\\tab MaKK "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Svensk versttning: Sopor "" (Indicator: "@hotmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Trke eviri:\\line Mehmetali KURAN \\line lhami TURAL "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 " : "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Bn dch ting Vit:\\line thanhtai2009 \\line caobach "" (Indicator: "@gmail."; File: "Ruf5FB6.tmp") Found reference to API "t MSG_176 "Bn dch ting Vit:\\line thanhtai2009 \\line caobach "" (Indicator: "@outlook."; File: "Ruf5FB6.tmp")2e:Ta0a,"rufus-3.13.exe" wrote bytes "b4361e75" to virtual address "0x751F025C" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "d83a1e75" to virtual address "0x751F01FC" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "b89012c173ffe0" to virtual address "0x751E3AD8" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "d83a0200" to virtual address "0x751E4E38" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "d83a0200" to virtual address "0x751E4D78" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "68130000" to virtual address "0x76261680" (part of module "WS2_32.DLL") "rufus-3.13.exe" wrote bytes "d83a1e75" to virtual address "0x751F0258" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "b4361e75" to virtual address "0x751F0278" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "c0df94771cf99377ccf893770d64957700000000c011d57600000000fc3ed57600000000e013d576000000009457a47625e09477c6e0947700000000bc6aa37600000000cf31d576000000009319a476000000002c32d57600000000" to virtual address "0x77491000" (part of module "NSI.DLL") "rufus-3.13.exe" wrote bytes "b81015c173ffe0" to virtual address "0x751E36B4" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "d83a1e75" to virtual address "0x751F0274" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "0efc977781ed9677ae869577c6e09477effd97772d169677c0fc9377da8f9e7760149877478d9577a8e294776089957700000000ad3726768b2d2676b641267600000000" to virtual address "0x738D1000" (part of module "DSUIEXT.DLL") "rufus-3.13.exe" wrote bytes "b88011c173ffe0" to virtual address "0x76261368" (part of module "WS2_32.DLL") "rufus-3.13.exe" wrote bytes "b4360200" to virtual address "0x751E4D68" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "711167027a3b6602ab8b02007f950200fc8c0200729602006cc805001ecd63027d266302" to virtual address "0x753307E4" (part of module "USER32.DLL") "rufus-3.13.exe" wrote bytes "b4360200" to virtual address "0x751E4EA4" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "b4361e75" to virtual address "0x751F01E4" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "d83a1e75" to virtual address "0x751F01E0" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "b4361e75" to virtual address "0x751F0200" (part of module "SSPICLI.DLL") "rufus-3.13.exe" wrote bytes "7d07987781ed9677ae869577c6e09477effd97772d16967760149877478d9577a8e294776089957700000000ad3726768b2d2676b641267600000000" to virtual address "0x737F1000" (part of module "WSHTCPIP.DLL")2f:T1009,".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74e60000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74e60000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74e60000 ".exe" loaded module "KERNEL32" at base 75870000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73fd0000 ".exe" loaded module "ADVAPI32.DLL" at base 74d00000 ".exe" loaded module "COMCTL32.DLL" at base 73840000 ".exe" loaded module "COMDLG32.DLL" at base 74d80000 ".exe" loaded module "CRYPT32.DLL" at base 75ba0000 ".exe" loaded module "GDI32.DLL" at base 74b40000 ".exe" loaded module "MSVCRT.DLL" at base 773e0000 ".exe" loaded module "OLE32.DLL" at base 74980000 ".exe" loaded module "SETUPAPI.DLL" at base 74300000 ".exe" loaded module "SHELL32.DLL" at base 75d30000 ".exe" loaded module "SHLWAPI.DLL" at base 75070000 ".exe" loaded module "USER32.DLL" at base 75120000 ".exe" loaded module "WINTRUST.DLL" at base 75aa0000 ".exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75870000 ".exe" loaded module "RPCRT4.DLL" at base 775a0000 ".exe" loaded module "SSPICLI.DLL" at base 742e0000 ".exe" loaded module "KERNEL32.DLL" at base 75870000 ".exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75aa0000 ".exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75ba0000 ".exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75870000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73f50000 ".exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77860000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74200000 ".exe" loaded module "RICHED20" at base 73ed0000 ".exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 73540000 ".exe" loaded module "COMCTL32" at base 73840000 ".exe" loaded module "OLEAUT32.DLL" at base 772c0000 ".exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75120000 ".exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75120000 ".exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74730000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77660000 ".exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74980000 ".exe" loaded module "WININET" at base 72ff0000 ".exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 73e60000 ".exe" loaded module "%WINDIR%\SYSWOW64\OLEACC.DLL" at base 72f90000 ".exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72630000 ".exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72f70000 ".exe" loaded module "WINHTTP.DLL" at base 72360000 ".exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72f70000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72300000 ".exe" loaded module "MSISO.DLL" at base 72110000 ".exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72f60000 ".exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 720c0000 ".exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 74a80000 ".exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72050000 ".exe" loaded module "%WINDIR%\SYSNATIVE\EN-US\SHELL32.DLL.MUI" at base 9a30000 ".exe" loaded module "%WINDIR%\SYSNATIVE\EN-US\URLMON.DLL.MUI" at base 9a30000 ".exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 71f4000030:T4e6,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}"; Key: "UPPERFILTERS") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}"; Key: "LOWERFILTERS") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}"; Key: "UPPERFILTERS") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}"; Key: "LOWERFILTERS") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{C166523C-FE0C-4A94-A586-F1A80CFBBF3E}"; Key: "UPPERFILTERS") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{C166523C-FE0C-4A94-A586-F1A80CFBBF3E}"; Key: "LOWERFILTERS") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: "UPPERFILTERS") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: "LOWERFILTERS")31:Tecb,Found malicious artifacts related to "185.199.111.153": ... URL: http://feeluso.github.io/feel (AV positives: 2/83 scanned on 01/08/2021 16:18:20) URL: http://hashub.github.io/2017/07/24/iTunes-Connect-%E6%9E%84%E5%BB%BA%E7%89%88%E6%9C%AC%E4%B8%8D%E6%98%BE%E7%A4%BA (AV positives: 3/83 scanned on 01/08/2021 16:15:30) URL: http://lbingrun.github.io/laboratory/source/sortdemo/frame/jquery (AV positives: 6/83 scanned on 01/08/2021 16:01:36) URL: http://agcasillasavalos.github.io/hynyoyaapps (AV positives: 6/83 scanned on 01/08/2021 15:40:12) URL: https://es5.github.io/ (AV positives: 1/83 scanned on 01/08/2021 15:03:11) File SHA256: 2bc99d6b4c90830299a2c28002af85db966c31faeb36345c762288bab0a3316d (AV positives: 4/76 scanned on 01/06/2021 11:50:16) File SHA256: d9db1e3f16d4f66663caef5c10e00fe0e48f131fc521e6ab3569b6d7a84f9953 (Date: 01/01/2021 06:46:51) File SHA256: 0d38426b0d85986e3a2b181e161159f3d8bb9b25e0d45643ec746805d82e5fc3 (Date: 12/30/2020 21:22:52) File SHA256: a928f081a10d014631b311832b7a67cc765b7f8c6a4bb4c0dc794b61e0ad8e84 (Date: 12/25/2020 00:45:23) File SHA256: 5f233d9fdc22bbdce62bc797c13169729eb070111bfb17cd56ad888a13f66f30 (AV positives: 45/76 scanned on 12/23/2020 02:21:16) File SHA256: 439651f79dcf5f16fdfac1ae5721f322111c8b375b3aff023914f1ccf7c389b2 (Date: 12/19/2020 10:56:52) File SHA256: 89d086a78050a9feacdf2bccb64fc09001f2654c3d18f60d9b71eed2b1f56321 (Date: 12/11/2020 05:00:21) File SHA256: 809cdd5621542b97a7270c41181d5f18daa5cd05852cad65c53dd5121e19c6c3 (AV positives: 1/76 scanned on 12/08/2020 12:19:23) File SHA256: 2410aa27b0e8ce78aa96558492aa902a46b175d814c786e222a86ba1b78c7dc7 (AV positives: 1/76 scanned on 12/08/2020 08:31:43) File SHA256: a2ebd9e2ff0dff4b9b3ee27bc4ce4402bb9abba95ca9f5cbe1586711bcdc6d26 (AV positives: 5/76 scanned on 12/03/2020 13:48:55) Found malicious artifacts related to "140.82.114.4": ... URL: https://github.com/xmrig/xmrig-proxy/releases/download/v5.5.1/ (AV positives: 2/83 scanned on 01/08/2021 16:08:40) URL: https://github.com/Itroublve/Token-Browser-Password-Stealer-Creator/blob/6.0/AVOID%20ME/Leaf.xNet.dll?raw=true (AV positives: 4/83 scanned on 01/08/2021 16:11:11) URL: https://github.com/Itroublve/Token-Browser-Password-Stealer-Creator/blob/6.0/AVOID%20ME/Newtonsoft.Json.dll?raw=true (AV positives: 4/83 scanned on 01/08/2021 15:45:41) URL: http://github.com/nwoolls/multiminer/releases/download/v4.3.1/ (AV positives: 1/83 scanned on 01/08/2021 15:08:57) URL: https://github.com/SecWiki/windows-kernel-exploits/raw/master/MS16-016/ (AV positives: 2/83 scanned on 01/08/2021 15:08:30) File SHA256: 4828f30a443a475e919fc56a15d37aba08ed4ff06a623eacc094fae542408318 (AV positives: 16/74 scanned on 01/07/2021 09:27:54) File SHA256: 9eb36c992f1d4bb2d27cb9c0d14b9b0c762d59e544b27754afc2bc0a9b219dcd (AV positives: 1/76 scanned on 01/07/2021 02:17:24) File SHA256: df7191c34f31d6f59ca96a27cf5866a96df5e656eac18aeda980c0dfe402f788 (AV positives: 44/76 scanned on 01/06/2021 04:57:29) File SHA256: 214c70cedd56224201e1e0d73fcd66e2163cf7b84ea44c5064fe3edbfed4450f (AV positives: 1/75 scanned on 01/06/2021 04:51:15) File SHA256: a559aa772fd136379155efa71f00c47aad34bbfeae6196b0fe1047d0645cbd26 (AV positives: 2/76 scanned on 01/05/2021 04:50:28) File SHA256: e9a1cc6e810a76457694b2345fc9730f4f2294e32784954d99286b1bd45f7768 (Date: 12/16/2020 13:15:05) File SHA256: 7ad1751438e62dd799fab893e6f2779234f60f5a4ede9ed3feb4c4b01bf12a3b (Date: 12/15/2020 07:46:22) File SHA256: b3e6cc9fbb1966c1c86af6b793fcc671489bf673c525f7a6b45d77004671fafe (Date: 12/13/2020 23:43:24) File SHA256: 2d8fedfbf72f7483f8df8661eb5f91e2e747028fb99e55a41addfd7c6f55488f (Date: 12/13/2020 23:43:20) File SHA256: 0ad645bab028c2b9abf24241e9756951ca9a75b1fbcba4bcdd43ae8a24d7b414 (Date: 12/13/2020 23:01:47)32:T812,"rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")33:T46c,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "https://secure.comodo.net/CPS0C" Pattern match: "crl.comodoca.com/COMODORSACodeSigningCA.crl0t" Pattern match: "crt.comodoca.com/COMODORSACodeSigningCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://s.symcd.com06" Pattern match: "http://s.symcb.com/universal-root.crl0" Pattern match: "https://d.symcb.com/rpa0@" Pattern match: "http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com0" Pattern match: "http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0" Pattern match: "https://rufus.ie" Pattern match: "https://www.gnu.org/licenses/gpl-3.0.html" Heuristic match: "rufus.ie" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Pattern match: "https://github.com/Chocobo1"34:Tef2,".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007324) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000042770000ce03000000002d6e427701d1aac211000000181a4073c0dc0c06ef004473010000000000000008bcce038000000000dc0c060000000084dc0c0670c84377c57ceeb3feffffff11000000503c41730e00000054dc0c06856a44771c23497794dc0c06f85f447708000000bb694377b2694377a9d1aac211000000181a40730e000000503c417368dc0c0611000000503c41730e00000098dc0c06856a44771c234977e0dc0c06b90e417336144173ae0e4173950c134e11000000181a40730e000000503c41731080ce03d87fce03950c134ea8dc0c060a5e407394dd0c06401441732d725d3bfeffffffae0e4173c80e4173503c417310dd0c06 (UID: 00000000-00007324) ".exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007324) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000601c8267a05c000ce03c06f0f74d0267a0580e3060168e30601d06f0f74ec267a05a74d0f7400000000d0267a05b74d0f74ea0eab3c4ebc127400000000d8816603bce306019ce30601c06f0f74d0267a05d4e30601a8e30601d06f0f740000000000000000000000008c587374b74d0f742a0eab3c0000000049f7b3d4c8267a050240008008e40601506a9377e1e12ea2feffffff18e406010016837498b6620354b01e7423879077e186907799f0b3d4000000008c587374c8267a050000000098b662030400000000168374e0e30601c8267a05b04d7e740fadd46800000000d8816603c8267a0513e61174000009742c531e740ce4060180eefd74 (UID: 00000000-00007324) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000060116e1167720cc060118cc060124cc06010300000080f6f57430cc0601aaec16770300000000000000e447f972b6ec1677576f6c5568cc06017de0167764e016770f6f6c55e447f97205000000f09df9720000000075e2f97286e2f972e8cc0601802b197707e54923feffffff74cc0601e0df16772002fb7284cc060149d9fa72c064fd722002fb7290cc060163d9fa722002fb72b4cc0601fa9df972010000000100000037068f77010000000b2e177706000000dad8fa72f8cc0601eecffa72c4dcfa72e2cffa728b956a9901000000010000000000000025d8b3d418000000f4cc060132ba9177a068fd7200000000000000000000000008cd0601 (UID: 00000000-00007324) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000042770000ce03000000002d6e427701d25fc311000000181ae071c0dff9072b24e4710100000000000000903579058000000000dff9070000000084dff90770c84377c57ceeb3feffffff11000000503ce1710e00000054dff907856a44771c23497794dff907f85f447708000000bb694377b2694377a9d25fc311000000181ae0710e000000503ce17168dff90711000000503ce1710e00000098dff907856a44771c234977e0dff907b90ee1713614e171ae0ee1714641f04d11000000181ae0710e000000503ce171d07bce03987bce034641f04da8dff9070a5ee07194e0f9074014e171fe3ceb3bfeffffffae0ee171c80ee171503ce17110e0f907 (UID: 00000000-00007324)35:T7a9,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "")36:T8af,"rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rufus-3.13.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rufus-3.13.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")37:T86f,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter COMCTL32.DLL (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter COMDLG32.DLL (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter Riched20 (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter WinInet (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Sysnative\en-US\shell32.dll.mui (UID: 00000000-00007324) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Sysnative\en-US\urlmon.dll.mui (UID: 00000000-00007324)38:T416,".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{E470CA73-47F1-4196-801C-7AAAA20F35E4}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "ENABLESMARTSCREEN"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{E470CA73-47F1-4196-801C-7AAAA20F35E4}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "**DEL.SHELLSMARTSCREENLEVEL"; Value: "20000000") ".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{4F19A2AB-0622-428A-8C34-5FA5F84931AB}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "ENABLESMARTSCREEN"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{4F19A2AB-0622-428A-8C34-5FA5F84931AB}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "**DEL.SHELLSMARTSCREENLEVEL"; Value: "20000000")39:T627,".exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '22388064'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22385080'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22385160'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22385280'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22386104'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22386144'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22387784'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22387864'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22385944'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22385984'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22386024'}" (UID: 00000000-00007324) ".exe" called "LoadResource with parameter {'hModule': '19070976', 'hResInfo': '22386064'}" (UID: 00000000-00007324)3a:T75a,".exe" called "GetWindowTextW" with parameter "More information" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Do you want to allow Rufus to check for application updates online?" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "4e006f00" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Yes" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "START" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "CLOSE" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "SELECT" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Use Rufus MBR with BIOS ID" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Check device for bad blocks" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "List USB Hard Drives" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Add fixes for old BIOSes (extra partition, align, etc.)" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Quick format" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Create extended label and icon files" - (UID: 00000000-00007324) ".exe" called "GetWindowTextA" with parameter "Rufus 3.13.1730" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Drive Properties" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Format Options" - (UID: 00000000-00007324) ".exe" called "GetWindowTextW" with parameter "Status" - (UID: 00000000-00007324)18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"GPT.INI","sha256":"c94d19972596583b944366b291a1d48b357e88835e7218e0f0d184ac1e29f05a","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}],"verdict":"undetected"},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"2f0350b56b0d0de5fe1c45230eefc687347cf8b92fbabad70dc823706034e175","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Ruf5FB6.tmp","sha256":"846e6608d48fc86ff22de70fa5c8c44a0dc12f0826810219713608eae509e6ed","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Registry.pol","sha256":"4cd929b630dc23acb305488f1da82d05fc971b9d85cfdea499704299d36934be","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"verdict":"undetected"},{"name":"rufus.ini~","sha256":"2acc0c0166ad0d25b05efd8610bb2dfc07bcd576740e3df8e2ec7aa3abacbc9c","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"verdict":"undetected"},{"name":"644B8874112055B5E195ECB0E8F243A4","sha256":"f198694e8822e6152ef26ac00d2c9ea46b8a132ed1f7978feeaf5a46d80ecd66","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"verdict":"undetected"},{"name":"rufus.ini","sha256":"2acc0c0166ad0d25b05efd8610bb2dfc07bcd576740e3df8e2ec7aa3abacbc9c","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"verdict":"undetected"},{"name":"RufD8B3.tmp","sha256":"846e6608d48fc86ff22de70fa5c8c44a0dc12f0826810219713608eae509e6ed","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}],"verdict":"undetected"},{"name":"gpt.ini","sha256":"f8488d0065d2ff40e9a2050f5af4f4aaf0503e882ddf325fd255d60d8a37cc01","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Fido_1_.ver","sha256":"4dacf00aae3bf5aef99f28293de58b854fa8cc75875b867130f331d64f530f41","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Ruf5F1E.tmp","sha256":"846e6608d48fc86ff22de70fa5c8c44a0dc12f0826810219713608eae509e6ed","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}],"verdict":"undetected"},{"name":"vxaction.log","sha256":"73337733e96276f4d3096842256c0f4a74cec06d06c0f18993a63c6a611ce615","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Ruf426E.tmp","sha256":"846e6608d48fc86ff22de70fa5c8c44a0dc12f0826810219713608eae509e6ed","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Ruf60C4.tmp","sha256":"846e6608d48fc86ff22de70fa5c8c44a0dc12f0826810219713608eae509e6ed","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%WINDIR%\\System32\\GroupPolicy\\GPT.INI","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"C:\\rufus-3.13.exe","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"C:\\rufus-3.13p.exe","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\comdlg32.dll.mui","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\comdlg32.dll.mui","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\User","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"C:","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"C:\\rufus.ini","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\User\\Registry.pol","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\gpedit.dll.mui","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\gpt.ini","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\gpedit.dll.mui","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"name":"SM0:7324:64:WilError_01","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global/Rufus","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"name":"DBWinMutex","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"name":"Global/Rufus","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"name":"Local\\SM0:7324:168:WilStaging_02","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"140.82.114.4","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"address":"185.199.109.153","country":"Netherlands","port":443,"protocol":"TCP","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"address":"185.199.108.153","country":"Netherlands","port":443,"protocol":"TCP","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"address":"185.199.111.153","country":"Netherlands","port":443,"protocol":"TCP","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"address":"23.63.75.153","country":"United States","port":80,"protocol":"TCP","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"140.82.114.3","country":"United States","domain":"github.com","registrar_creation_date":"2007-10-09T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_organization":"GitHub, Inc.","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"ttl":59},{"address":"185.199.109.153","country":"Netherlands","domain":"rufus.ie","registrar_name_servers":"ns1.blacknight.com","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"ttl":3217},{"address":"23.63.75.153","country":"United States","domain":"crl.identrust.com","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"ttl":7978}],"http_requests":[{"header":"GET /DSTROOTCAX3CRL.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.identrust.com","host":"crl.identrust.com","host_ip":"23.63.75.153:80","method":"GET","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"url":"/DSTROOTCAX3CRL.crl"}]},"process_activity":{"all_imported_dlls":["activeds.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","duser.dll","CoreUIComponents.dll","SensApi.dll","netapi32.dll","crypt32.dll","api-ms-win-core-synch-l1-2-0.dll","samcli.dll","atl.dll","comdlg32.dll","KernelBase.dll","ucrtbase.dll","dhcpcsvc6.dll","wkscli.dll","wshqos.dll","api-ms-win-downlevel-user32-l1-1-0.dll","cfgmgr32.dll","dfscli.dll","OnDemandConnRouteHelper.dll","dnsapi.dll","powrprof.dll","wintrust.dll","srvcli.dll","ntdll.dll","dhcpcsvc.dll","winnsi.dll","rpcrt4.dll","comctl32.dll","nlaapi.dll","setupapi.dll","combase.dll","netutils.dll","IPHLPAPI.DLL","dssec.dll","cryptnet.dll","fltLib.dll","dsuiext.dll","wow64.dll","user32.dll","wow64win.dll","webio.dll","msasn1.dll","nsi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dsrole.dll","riched20.dll","imagehlp.dll","wtsapi32.dll","ncrypt.dll","cryptbase.dll","shell32.dll","VxSSL32.dll","msls31.dll","msvcp_win.dll","rpcss.dll","authz.dll","rsaenh.dll","imageres.dll","usp10.dll","WinTypes.dll","dwmapi.dll","profapi.dll","IconCodecService.dll","bcrypt.dll","ws2_32.dll","lpk.dll","windows.storage.dll","logoncli.dll","iertutil.dll","netprofm.dll","schannel.dll","oleacc.dll","dui70.dll","urlmon.dll","ntdsapi.dll","imm32.dll","adsldpc.dll","ntmarta.dll","clbcatq.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","bcryptprimitives.dll","TextInputFramework.dll","cryptsp.dll","kernel.appcore.dll","win32u.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","devobj.dll","sechost.dll","normaliz.dll","ole32.dll","uxtheme.dll","version.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","slc.dll","secur32.dll","api-ms-win-downlevel-version-l1-1-0.dll","mswsock.dll","SHCore.dll","msIso.dll","mpr.dll","WSHTCPIP.DLL","WindowsCodecs.dll","CoreMessaging.dll","kernel32.dll","gpapi.dll","winhttp.dll","framedynos.dll","wininet.dll","oleaccrc.dll","advapi32.dll","FWPUCLNT.DLL","gdi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","msctf.dll","oleaut32.dll","RpcRtRemote.dll","msvcrt.dll","rasadhlp.dll","shlwapi.dll","wow64cpu.dll","gdi32full.dll","gpedit.dll","Wldap32.dll","userenv.dll","npmproxy.dll","wship6.dll","ExplorerFrame.dll","credssp.dll","sspicli.dll"],"processes":[{"command_line":"","icon":"$22","name":"rufus-3.13.exe","normalized_path":"C:\\rufus-3.13.exe","pid":2088,"ppid":0,"sha256":"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb","uid":"00066236-00002088"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E470CA73-47F1-4196-801C-7AAAA20F35E4}USER\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}USER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E470CA73-47F1-4196-801C-7AAAA20F35E4}USER\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\WINDOWSUPDATE\\","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}USER\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E470CA73-47F1-4196-801C-7AAAA20F35E4}USER\\SOFTWARE\\","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}USER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}USER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\AKEO CONSULTING\\RUFUS\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E470CA73-47F1-4196-801C-7AAAA20F35E4}USER\\","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}USER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]}],"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}USER\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\NODRIVETYPEAUTORUN\\NODRIVETYPEAUTORUN","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}USER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\NODRIVETYPEAUTORUN\\NODRIVETYPEAUTORUN","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}USER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}USER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}USER\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{10AD224C-E96D-452F-852A-8D4225048C76}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E7EDF081-7450-49E5-A0F1-27A000FB2755}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{FC2B8153-1658-401B-8168-BE68E7B58B95}MACHINE\\SOFTWARE\\","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{F9796649-BA99-44A8-BD7E-B1884AE8A6C6}MACHINE\\SOFTWARE\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{76ECBEFE-D1E9-4212-B06D-2ADBA7DD65F4}MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]}],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files","User Comment","Simulated analysis"],"sandbox_reports":[{"analysis_start_time":"2023-08-24T18:02:12+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"64e79b230ef036091c0d3b16","indicators_count":{"informative":90,"malicious":4,"suspicious":34},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"rufus-3.13p.exe","tags":["Extracted Files","User Comment","Simulated analysis"],"verdict":"clean"},{"analysis_start_time":"2023-01-11T00:35:00+00:00","contacted_countries":["NLD","USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"63be0433ea37c6613d46dd29","indicators_count":{"informative":47,"malicious":2,"suspicious":28},"is_in_unified_schema":false,"state":"SUCCESS","submit_name":"rufus-3.13p.exe","tags":["Network Traffic","Extracted Files","User Comment"],"verdict":"clean"},{"analysis_start_time":"2021-05-11T05:32:56+00:00","contacted_countries":["NLD"],"environment_description":"Windows 7 64 bit","environment_id":120,"id":"609a170263500a2e37030c87","indicators_count":{"informative":18,"malicious":2,"suspicious":21},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"rufus-3.13.exe","tags":["Network Traffic","Extracted Files","User Comment"],"verdict":"clean"},{"analysis_start_time":"2021-05-11T05:24:36+00:00","contacted_countries":["NLD"],"environment_description":"Windows 7 32 bit","environment_id":100,"id":"609a150ebbf4774d307e4083","indicators_count":{"informative":21,"malicious":2,"suspicious":28},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"rufus-3.13p.exe","tags":["Network Traffic","Extracted Files","User Comment"],"verdict":"clean"},{"analysis_start_time":"2021-01-30T03:51:59+00:00","contacted_countries":["NLD"],"environment_description":"Windows 7 32 bit","environment_id":100,"id":"6014d7dcc6c4e80018152808","indicators_count":{"informative":21,"malicious":2,"suspicious":27},"is_in_unified_schema":false,"state":"SUCCESS","submit_name":"rufus-3.13p.exe","tags":["Network Traffic","Extracted Files","User Comment"],"verdict":"clean"},{"analysis_start_time":"2021-01-30T03:41:43+00:00","contacted_countries":["NLD","USA"],"environment_description":"Windows 7 64 bit","environment_id":120,"id":"6014d57204e50474d914fe64","indicators_count":{"informative":17,"malicious":3,"suspicious":11},"is_in_unified_schema":false,"state":"SUCCESS","submit_name":"rufus-3.13.exe","tags":["Multi-Process","Network Traffic","User Comment"],"verdict":"clean"},{"analysis_start_time":"2021-01-08T16:44:49+00:00","contacted_countries":["NLD","USA"],"environment_description":"Windows 7 32 bit (HWP Support)","environment_id":110,"id":"5ff88c001ce4b17dc562d480","indicators_count":{"informative":20,"malicious":2,"suspicious":21},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"rufus-3.13.exe","tags":["Network Traffic","Extracted Files","User Comment"],"verdict":"clean"},{"analysis_start_time":"2021-01-05T09:14:41+00:00","contacted_countries":["NLD"],"environment_description":"Windows 7 32 bit","environment_id":100,"id":"5ff42df7aa82e87d612cd5f4","indicators_count":{"informative":18,"malicious":2,"suspicious":26},"is_in_unified_schema":false,"state":"SUCCESS","submit_name":"rufus-3.13p.exe","tags":["Network Traffic","Extracted Files","User Comment"],"verdict":"clean"},{"analysis_start_time":"2020-11-20T17:09:19+00:00","contacted_countries":["NLD"],"environment_description":"Windows 7 32 bit","environment_id":100,"id":"5fb7f83a6934a630005a4734","indicators_count":{"informative":18,"malicious":2,"suspicious":23},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"rufus-3.13p.exe","tags":["Network Traffic","Extracted Files","User Comment"],"threat_score":42,"verdict":"clean"},{"analysis_start_time":"2020-11-20T14:58:08+00:00","contacted_countries":["NLD"],"environment_description":"Windows 7 64 bit","environment_id":120,"id":"5fb7d97d95763057544c3b66","indicators_count":{"informative":17,"malicious":1,"suspicious":23},"is_in_unified_schema":false,"state":"SUCCESS","submit_name":"rufus-3.13.exe","tags":["Network Traffic","Extracted Files","User Comment"],"verdict":"clean"}],"stats":{"contacted_hosts_count":5,"contacted_urls_count":1,"dns_resolutions_count":3,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":14,"files_deleted_count":0,"files_written_count":50,"http_requests_count":1,"imported_dlls_count":130,"injected_processes_count":0,"mutex_created_count":10,"process_count":1,"registry_keys_created_count":56,"registry_keys_deleted_count":53,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":109,"script_calls_count":0,"spawned_processes_count":1}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Modifies System Certificates Settings"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"details_count":1,"name":"Remote Access","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"details_count":5,"name":"Fingerprint","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"details":[{"detail":"Possibly tries to implement anti-virtualization techniques"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"details_count":1,"name":"Spreading","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 1 domain and 1 host"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Desktop Protocol"},{"attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Local Storage"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Impact","technique":"Disk Content Wipe"},{"attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Commonly Used Port"},{"attack_id":"T1484.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1484/001","identifiers":[{"type":"malicious","value":"Modifies Group policy settings registry keys"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Group Policy Modification"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable Windows defender Anti Spyware"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"},{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"tactic":"Persistence","technique":"Kernel Modules and Extensions"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Email Accounts"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"tactic":"Persistence","technique":"Hooking"},{"attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Initial Access","technique":"Replication Through Removable Media"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"malicious","value":"Modifies System Certificates Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies Windows Auto-Updates feature"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credential API Hooking"}],"rule_matches":{},"sandbox_signatures":[{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00007324-00000C25-43516820]\n Observed system executable string:\"%WINDIR%\\Sysnative\\en-US\\shell32.dll.mui\" [Source: 00000000-00007324-00000C25-51330502]\n Observed system executable string:\"%WINDIR%\\Sysnative\\en-US\\urlmon.dll.mui\" [Source: 00000000-00007324-00000C25-51542772]","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$23","id":"api-55","level":"informative","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" trying to access non-existent file \"C:\\RUFUS-3.13P.EXE.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\RUFUS.LOC\"\n \".exe\" trying to access non-existent file \"C:\\rufus.loc\"\n \".exe\" trying to access non-existent file \"C:\\rufus-3.13p.exe.Local\\\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"\n \".exe\" trying to access non-existent file \"C:\\rufus.com\"","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}","id":"api-40","level":"suspicious","mitre_attack_id":"T1056.001","name":"Calls an API typically used for keylogging","origin":"API Call","relevance":10,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007324.00000000.68895.03610000.00000004.mdmp\")","id":"string-280","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to cryptographic keys","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" reads file \"c:\\rufus.ini\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" called \"GetUserNameA\" (UID: 00000000-00007324)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" reads file \"C:\\rufus.ini\"","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E470CA73-47F1-4196-801C-7AAAA20F35E4}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{4F19A2AB-0622-428A-8C34-5FA5F84931AB}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","id":"registry-24","level":"malicious","mitre_attack_id":"T1112","name":"Modifies Windows Auto-Updates feature","origin":"Registry Access","relevance":9,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb.bin\" was detected as \"UPX -> www.upx.sourceforge.net\"","id":"static-18","level":"informative","mitre_attack_id":"T1045","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found PE header \"MZ\" - Source: \"00000000-00007324.00000000.68895.01230000.00000002.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73AA0000","id":"module-2","level":"informative","mitre_attack_id":"T1179","name":"Loads rich edit control libraries","origin":"Loaded Module","sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13.exe\" created file \"%TEMP%\\RufD8B3.tmp\"","id":"api-4","level":"informative","name":"Creates a writable file in a temporary directory","origin":"API Call","relevance":1,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"\"rufus-3.13.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","id":"registry-61","level":"suspicious","mitre_attack_id":"T1076","name":"Reads terminal service related keys (often RDP related)","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Network Related","description":"$24","id":"network-21","level":"malicious","name":"Malicious artifacts seen in the context of a contacted host","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"System Security","description":"$25","id":"registry-19","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"General","description":"Pattern match: \"support@akeo.ie0\"\n Pattern match: \"pete@akeo.ie\"\n Pattern match: \"berzabel@yahoo.com\"\n Pattern match: \"mmmeow@gmail.com\"\n Pattern match: \"dkmr_main@hotmail.com\"\n Pattern match: \"richard.kahl@seznam.cz\"\n Pattern match: \"zenzay@gmail.com\"\n Pattern match: \"rcp@eclipso.me\"\n Pattern match: \"mail@thilo-langbein.de\"\n Pattern match: \"kotsos.marga@gmail.com\"\n Pattern match: \"familyguyfan79@gmail.com\"\n Pattern match: \"arifpedia@gmail.com\"\n Pattern match: \"chantella-eng@live.com\"\n Pattern match: \"ho82.kr@gmail.com\"\n Pattern match: \"alibaba@inbox.lv\"\n Pattern match: \"gintaras.venslovas@gmail.com\"\n Pattern match: \"aman.tifli@gmail.com\"\n Pattern match: \"translator744@outlook.com\"","id":"string-63","level":"suspicious","mitre_attack_id":"T1114","name":"Found a potential E-Mail address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"Ruf5FB6.tmp\")\n Found string \"t MSG_125 \"Set the size of the persistent partition for live USB media. Setting the size to 0 disables the persistent partition.\"\" (Indicator: \"\"set \"; File: \"Ruf5FB6.tmp\")\n Found string \"t MSG_126 \"Set the partition size units.\"\" (Indicator: \"\"set \"; File: \"Ruf5FB6.tmp\")\n Found string \"t MSG_126 \"Set saiz unit pemetakan.\"\" (Indicator: \"\"set \"; File: \"Ruf5FB6.tmp\")","id":"string-326","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve environment variable settings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"rufus-3.13.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"suspicious","mitre_attack_id":"T1012","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13p.bin\" has an executable section named \"UPX0\"\n \"rufus-3.13p.bin\" has an executable section named \"UPX1\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"4d1f7c7-76af-4f28-9ccd-7f6cb6468601@ncalrpc:\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007324.00000000.68895.03610000.00000004.mdmp\")","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; File: \"rufus-3.13p.bin\")\n Found api reference \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-602","level":"suspicious","mitre_attack_id":"T1573","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":2,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"rufus-3.13.exe\" checked file \"C:\"","id":"api-35","level":"malicious","name":"Checks for a resource fork (ADS) file","origin":"API Call","relevance":5,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13p.bin\" has an writable section named \"UPX0\"\n \"rufus-3.13p.bin\" has an writable section named \"UPX1\"\n \"rufus-3.13p.bin\" has an writable section named \".rsrc\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007324-00000C26-50002467\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007324-00000C26-50003033\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007324-00000C26-50003596\")\n Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00007324-00000C26-50003798\")\n Found reference to API \"HttpQueryInfoA\" (Indicator: \"HttpQueryInfo\"; Source: \"00000000-00007324-00000C26-50004137\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007324-00000C26-50041168\")","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"rufus-3.13.exe\" opened \"%TEMP%\\RufD8B3.tmp\" with delete access\n \"rufus-3.13.exe\" opened \"C:\\rufus.com\" with delete access","id":"api-25","level":"suspicious","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; File: \"rufus-3.13p.bin\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13p.bin\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x61a015,lea\tedi, [esi - 0x219015],push\tedi,mov\tebp, esp,lea\tebx, [esp - 0x3e80],xor\teax, eax,push\teax,cmp\tesp, ebx,jne\t0x7274c8,inc\tesi,inc\tesi,push\tebx,push\t0x325b8a,push\tedi,add\tebx, 4,push\tebx,push\t0x10d48e,push\tesi,add\tebx, 4,push\tebx,push\teax,mov\tdword ptr [ebx], 0x20003,push\tebp,push\tedi,push\tesi,push\tebx,sub\tesp, 0x7c,mov\tedx, dword ptr [esp + 0x90],mov\tdword ptr [esp + 0x74], 0,mov\tbyte ptr [esp + 0x73], 0,mov\tebp, dword ptr [esp + 0x9c],lea\teax, [edx + 4],mov\tdword ptr [esp + 0x78], eax,\"","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$27","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \".exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"\".exe\" called \"InternetOpenA with parameter Rufus/3.13.1730 (Windows NT 10.0; WOW64)\" (UID: 00000000-00007324)","id":"api-199","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API used to connect to internet","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77860000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73680000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$28","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\RUFUS-3.13P.EXE.LOCAL\"\n \".exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleaut32.dll\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"t IDC_QUICK_FORMAT \"Format cepat\"\" (Indicator: \"\"format \"; File: \"Ruf5FB6.tmp\")\n Found string \"t MSG_056 \"Format cepat tidak tersedia bagi perangkat ini.\"\" (Indicator: \"\"format \"; File: \"Ruf5FB6.tmp\")\n Found string \"t MSG_254 \"Format paksa FAT32 yang besar\"\" (Indicator: \"\"format \"; File: \"Ruf5FB6.tmp\")\n Found string \"t IDC_QUICK_FORMAT \"Format pantas\"\" (Indicator: \"\"format \"; File: \"Ruf5FB6.tmp\")\n Found string \"t MSG_056 \"Format pantas tidak boleh digunakan pada peranti ini.\"\" (Indicator: \"\"format \"; File: \"Ruf5FB6.tmp\")\n Found string \"Format Options\" (Indicator: \"format \"; Source: \"00000000-00007324-00000455-18630985038\")","id":"string-407","level":"informative","mitre_attack_id":"T1561.001","name":"Contains ability to format disks","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"VirtualProtect\n GetProcAddress\n LoadLibraryA\n ShellExecuteA","id":"static-1","level":"suspicious","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 9C:E9:A7:1C:CA:B3:B3:8A:74:78:1B:97:5F:1C:22:82:22:CF:7D:3B; see report for more information)\n The input sample is signed with a certificate issued by \"CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1116","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$29","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13p.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13p.bin\" was detected as \"UPX\" and name: \"Packer\"\n \"rufus-3.13p.bin\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"rufus-3.13.exe\" at 00066236-00002088-00000033-2871884","id":"api-10","level":"suspicious","name":"Queries kernel debugger information","origin":"API Call","relevance":6,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"General","description":"\"GET /DSTROOTCAX3CRL.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.identrust.com\"","id":"network-2","level":"informative","name":"GETs files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains reference to cryptographic keys","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2b","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"IsWow64Process\" with parameter \"7324\" - (UID: 00000000-00007324)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus.ie\"","id":"network-0","level":"informative","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 185.199.108.153 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1043","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"rufus-3.13.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","id":"registry-25","level":"suspicious","mitre_attack_id":"T1012","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"$2d","id":"string-235","level":"informative","mitre_attack_id":"T1585.002","name":"Found email domains (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"UPX1 with unusual entropies 7.99972167039","id":"static-6","level":"suspicious","name":"PE file has unusual entropy sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$2e","id":"hooks-8","level":"suspicious","mitre_attack_id":"T1179","name":"Installs hooks/patches the running process","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"$2f","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$30","id":"registry-106","level":"informative","mitre_attack_id":"T1082","name":"Read system defined device setup information from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"$31","id":"network-27","level":"malicious","name":"Multiple malicious artifacts seen in the context of different hosts","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13p.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"\".exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /Fido.ver\" - (UID: 00000000-00007324)","id":"api-143","level":"informative","mitre_attack_id":"T1071","name":"Calls an API typically used to create a new HTTP request","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"\"2.5.4.6\"\n \"2.5.4.17\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.9\"\n \"2.5.4.10\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.19\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.4.3\"","id":"string-14","level":"suspicious","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global/Rufus\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global/Rufus\"\n \"DBWinMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"$32","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"rufus-3.13.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","id":"registry-29","level":"suspicious","mitre_attack_id":"T1012","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","origin":"Registry Access","relevance":3,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"\" (Indicator: \"GetVersion\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{E470CA73-47F1-4196-801C-7AAAA20F35E4}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{4F19A2AB-0622-428A-8C34-5FA5F84931AB}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")","id":"registry-76","level":"malicious","mitre_attack_id":"T1562.001","name":"Tries to disable Windows defender Anti Spyware","origin":"Registry Access","relevance":7,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"GetVersionExA\" with parameter 9c0000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007324)\n \".exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000080a1f0128569c77a8e40601591690770100000008000000010000000000610300000000100000000000000000000000020000000200000000006103010000000800000000000000c8e40601ee13907701000000ee1390770800000000000000080000000100000000e70601ad9cf373000061030800000001000000 (UID: 00000000-00007324)","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" queries basic process information of the \"C:\\rufus-3.13p.exe\" (UID: 7324)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","id":"registry-9","level":"suspicious","mitre_attack_id":"T1012","name":"Checks warning level of secure to non-secure traffic redirection","origin":"Registry Access","relevance":7,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13.exe\" touched \"Group Policy Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{EA502722-A23D-11D1-A7D3-0000F87571E3}\")\n \"rufus-3.13.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \"rufus-3.13.exe\" touched \"Network List Manager\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \"rufus-3.13.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\TREATAS\")\n \"rufus-3.13.exe\" touched \"MSAA AccPropServices\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\\TREATAS\")\n \"rufus-3.13.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","id":"registry-72","level":"informative","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"$33","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"\"rufus-3.13.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1215","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$34","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Ruf5FB6.tmp\" has type \"UTF-8 Unicode text with very long lines with CRLF line terminators\" - Location: [%TEMP%\\Ruf5FB6.tmp]","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"$35","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb.bin\" claims program is from Thu Jan 1 00:00:00 1970","id":"static-3","level":"suspicious","name":"Timestamp in PE header is very old or in the future","origin":"Static Parser","relevance":10,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"\"rufus-3.13.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"rufus-3.13.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"rufus-3.13.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"rufus-3.13.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"rufus-3.13.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"External Systems","description":"0/69 Antivirus vendors marked sample as malicious (0% detection rate)","id":"avtest-1","level":"informative","name":"Sample was identified as clean by Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.9607766990037305","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: rufus-3.13p.bin)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: rufus-3.13p.bin]","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13.exe\" searching for window \"Rufus 3.13.1730 \"\n \"rufus-3.13.exe\" searching for class \"Shell_TrayWnd\"","id":"api-70","level":"informative","mitre_attack_id":"T1010","name":"Scanning for window names","origin":"API Call","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"185.199.108.153:443\"","id":"network-1","level":"informative","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to \"t MSG_312 \"Extra hashes (SHA512)\"\" (Indicator: \"SHA512\"; File: \"Ruf5FB6.tmp\")\n Found reference to \"Extra hashes (SHA512)\" (Indicator: \"SHA512\"; Source: \"00000000-00007324.00000000.68895.05790000.00000004.mdmp\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \"UPX1\" is \"0x10e200\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Destruction","description":"\".exe\" marked \"C:\\rufus.ini~\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Ruf5FB6.tmp\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Ruf5FB6.tmp\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" called \"NtQueueApcThread\" (UID: 00000000-00007324)","id":"api-85","level":"informative","mitre_attack_id":"T1055.004","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007324.00000000.68895.00E66000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007324.00000000.68895.03610000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007324.00000000.68895.03610000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rufus-3.13.exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \"UPX0\" is \"0x219000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x10f000\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS url \"https://rufus.ie\"\n Found HTTPS url \"https://www.gnu.org\"","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ruf5fb6.tmp\"\n \".exe\" writes file \"c:\\windows\\syswow64\\grouppolicy\\gpt.ini\"\n \".exe\" writes file \"c:\\windows\\system32\\grouppolicy\\machine\\registry.pol\"\n \".exe\" writes file \"c:\\windows\\system32\\grouppolicy\\gpt.ini\"\n \".exe\" writes file \"c:\\rufus.ini~\"\n \".exe\" writes file \"c:\\rufus.ini\"\n \".exe\" writes file \"%windir%\\syswow64\\grouppolicy\\gpt.ini\"\n \".exe\" writes file \"%windir%\\system32\\grouppolicy\\machine\\registry.pol\"\n \".exe\" writes file \"%windir%\\system32\\grouppolicy\\gpt.ini\"\n \"rufus-3.13p.exe\" writes file \"%temp%\\ruf5fb6.tmp\"\n \"rufus-3.13p.exe\" writes file \"%windir%\\system32\\grouppolicy\\machine\\registry.pol\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.1 [tls.handshake.version: 0x00000302]","id":"network-53","level":"malicious","mitre_attack_id":"T1573","name":"Making HTTPS connections using insecure TLS/SSL version","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"$38","id":"registry-148","level":"malicious","mitre_attack_id":"T1484.001","name":"Modifies Group policy settings registry keys","origin":"Registry Access","relevance":5,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb.bin\" has a section named \"UPX0\"\n \"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb.bin\" has a section named \"UPX1\"","id":"static-7","level":"suspicious","mitre_attack_id":"T1045","name":"PE file is packed with UPX","origin":"Static Parser","relevance":10,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007324)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Calls an API typically used to find device information\n Matched sigs: Calls an API typically used to enumerate device information\n Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM)\n Matched sigs: Possibly tries to implement anti-virtualization techniques","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"rufus-3.13.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUFUS-3.13.EXE\")\n \"rufus-3.13.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUFUS-3.13.EXE\")","id":"registry-55","level":"informative","mitre_attack_id":"T1012","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb.bin\" has an entrypoint in section \"UPX1\"","id":"static-4","level":"suspicious","name":"Entrypoint in PE header is within an uncommon section","origin":"Static Parser","relevance":10,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"rufus-3.13.exe\" read file \"%WINDIR%\\System32\\GroupPolicy\\GPT.INI\"\n \"rufus-3.13.exe\" read file \"%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini\"","id":"api-6","level":"suspicious","name":"Reads configuration files","origin":"API Call","relevance":4,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"category":"General","description":"The entire certificate chain of the input sample was validated successfully.","id":"certificate-2","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a valid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"\"rufus-3.13.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1112","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"GPT.INI\" has type \"data\"\n \"gpt.ini\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4817 bytes 1 file\"\n \"Registry.pol\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"\n \"RufD8B3.tmp\" has type \"UTF-8 Unicode text with very long lines with CRLF line terminators\"","id":"binary-0","level":"informative","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"\"rufus-3.13.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","id":"registry-36","level":"suspicious","mitre_attack_id":"T1012","name":"Queries sensitive IE security settings","origin":"Registry Access","relevance":8,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$39","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\"t MSG_176 \": \\\\line Chocobo1 \"\" (Indicator: \"github.com\")","id":"string-135","level":"informative","name":"Found well known domains (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 775A0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100729044\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100729044\"\n \"cx\": \"88\"\n \"cy\": \"26\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100729044\"\n \"cx\": \"133\"\n \"cy\": \"26\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100729044\"\n \"cx\": \"17\"\n \"cy\": \"551\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16844209\"\n \"cx\": \"17\"\n \"cy\": \"30\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16844209\"\n \"cx\": \"444\"\n \"cy\": \"23\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100729044\"\n \"cx\": \"444\"\n \"cy\": \"25\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"436275430\"\n \"cx\": \"95\"\n \"cy\": \"25\"}","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"t MSG_265 \"VMWare disk detection\"\" (Indicator: \"vmware\")\n \"t MSG_265 \" VMWare\"\" (Indicator: \"vmware\")\n \"t MSG_265 \" VMWare \"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare \"\" (Indicator: \"vmware\")\n \"t MSG_265 \"Otkrivanje VMware diska\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare detekce disk\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare disk detektering\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare-schijfdetectie\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMWare-levyn havaitseminen\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"Dtection de disque VMWare\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMware-Laufwerkserkennung\"\" (Indicator: \"vmware\")\n \"t MSG_265 \" VMWare\"\" (Indicator: \"vmware\")\n \"t MSG_265 \"VMware lemez szlelse\"\" (Indicator: \"vmware\")","id":"string-1","level":"suspicious","mitre_attack_id":"T1497","name":"Possibly tries to implement anti-virtualization techniques","origin":"File/Memory","relevance":4,"sources":[{"report_id":"609a170263500a2e37030c87","report_type":"sandbox"},{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"rufus-3.13p.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007324.00000000.68895.01559000.00000004.mdmp\")","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \"UPX0\" is zero","id":"static-5","level":"informative","name":"PE file contains zero-size sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"609a150ebbf4774d307e4083","report_type":"sandbox"},{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"},{"report_id":"5ff88c001ce4b17dc562d480","report_type":"sandbox"},{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"System Security","description":"\"rufus-3.13p.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\"; Key: \"DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\")\n \"rufus-3.13p.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\"; Key: \"BLOB\")","id":"registry-38","level":"malicious","mitre_attack_id":"T1112","name":"Modifies System Certificates Settings","origin":"Registry Access","relevance":8,"sources":[{"report_id":"5fb7f83a6934a630005a4734","report_type":"sandbox"}]},{"category":"General","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","id":"summary-6","level":"informative","name":"Sample shows a variety of benign indicators","origin":"Indicator Combinations","relevance":10,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3a","id":"api-151","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get active windows title","origin":"API Call","relevance":3,"sources":[{"report_id":"64e79b230ef036091c0d3b16","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":0,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":0,"suspicious_count":0,"total_engines":23},"mitre_attacks":{"total":54},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":97,"malicious_count":8,"suspicious_count":25,"total":130}},"summary":{"score":0,"tags":["Rufus-3","tag"],"verdict":"clean"}},"metadata":{"file_info":{"file_name":"rufus-3.13p.exe","file_size":1156152,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"Unknown","md5":"c844fa688f3aafa80790ecd6a204bbb7","sha1":"da498e3e80186ee16620f56a601e19fbdc1f8551","sha256":"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb","sha512":"442ab6f55fe3b9b648290d4f4ff6ac6bd3d3fe906936bbb26f7a9b31b52ff02aab6601cf342d3e11f705260585708aff80b45cf40633daf69d41d691d399a4df","ssdeep":"Unknown"},"submissions":{"first_seen":1605884286000,"last_multi_scan":1745578394000,"last_seen":1745578394000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["5fb7f83a6934a630005a4734","5ff88c001ce4b17dc562d480","64e79b230ef036091c0d3b16","609a170263500a2e37030c87","609a150ebbf4774d307e4083"]},"schema_version":"1.0.9","sha256":"ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb","threat_score":0,"unified_at":"2026-09-16T19:48:15.154Z","unified_at_epoch_ms":1789588095154,"verdict":"clean"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Clean Sample ec3136b053bd… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample ec3136b053bd…. Threat score 0/100. 0/23 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb"}],["$","meta","4",{"property":"og:title","content":"Clean Sample ec3136b053bd… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample ec3136b053bd…. Threat score 0/100. 0/23 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ec3136b053bd1559ad7ec1ea104113898093b886bf519e6117b138ef2e691cbb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample ec3136b053bd… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample ec3136b053bd…. Threat score 0/100. 0/23 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]