Create Interactive Tour

Analysis Report rufus-3.14p.exe

Overview

General Information

Sample Name:	rufus-3.14p.exe
Analysis ID:	420143
MD5:	c1df434cf15aeb31783e1144b8a30059
SHA1:	1c385ec41d5f20ab411bd20e792ad8e7da7feaf9
SHA256:	c0ccf4f480545b50169cc1f5bf92b357ce588520cb8534128200ca48fc6ae588
Infos:
Most interesting Screenshot:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Changes autostart functionality of drives

Drops PE files with a suspicious file extension

Modifies Group Policy settings

Tries to delay execution (extensive OutputDebugStringW loop)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read device registry values (via SetupAPI)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables driver privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries device information via Setup API

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

rufus-3.14p.exe (PID: 6836 cmdline: 'C:\Users\user\Desktop\rufus-3.14p.exe' MD5: C1DF434CF15AEB31783E1144B8A30059)

rufus-3.14p.exe (PID: 6872 cmdline: 'C:\Users\user\Desktop\rufus-3.14p.exe' MD5: C1DF434CF15AEB31783E1144B8A30059)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

• Cryptography
• Compliance
• Spreading
• Networking
• Spam, unwanted Advertisements and Ransom Demands
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D3A1E7 CryptAcquireContextW,CryptImportKey,CryptCreateHash,CryptHashData,CryptVerifySignatureW,CryptDestroyHash,CryptReleaseContext,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D393F7 calloc,GetModuleFileNameW,GetLastError,CryptQueryObject,Sleep,CryptMsgGetParam,CryptMsgGetParam,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,calloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringA,_strcmpi,CertGetNameStringA,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D393F7 calloc,GetModuleFileNameW,GetLastError,CryptQueryObject,Sleep,CryptMsgGetParam,CryptMsgGetParam,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,calloc,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringA,_strcmpi,CertGetNameStringA,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D4CBB9 CryptMsgGetParam,GetLastError,_snprintf,strlen,calloc,FormatMessageW,GetLastError,WideCharToMultiByte,??3@YAXPAX@Z,SetLastError,SetLastError,GetLastError,_snprintf,SetLastError,_snprintf,

Source: rufus-3.14p.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED

Source: rufus-3.14p.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.154:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: rufus-3.14p.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Projects\uefi-ntfs\arm\Release\bootarm.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp
Source:	Binary string: C:\Projects\uefi-ntfs\aa64\Release\bootaa64.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp
Source:	Binary string: C:\Projects\uefi-ntfs\ia32\Release\bootia32.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp
Source:	Binary string: C:\Projects\uefi-ntfs\x64\Release\bootx64.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp

Spreading:

Changes autostart functionality of drives

Show sources

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\group policy objects\{ACEF4A73-C5D5-48AF-B032-7CA9414F6868}Machine\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer NoDriveTypeAutorun

Jump to behavior

Source: rufus-3.14p.exe	Binary or memory string: Using autorun.inf label for drive %c: '%s'
Source: rufus-3.14p.exe	Binary or memory string: #:\autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: Ignoring autorun.inf label for drive %c: %s
Source: rufus-3.14p.exe	Binary or memory string: %sautorun.inf
Source: rufus-3.14p.exe	Binary or memory string: [autorun] icon = autorun.ico label = %s
Source: rufus-3.14p.exe	Binary or memory string: buat cakera boot" t MSG_165 "Klik untuk memilih atau memuat turun imej..." t MSG_166 "Klik kotak ini untuk membenarkan paparan label antarabangsa dan menetapkan ikon cakera (akan membuat fail autorun.inf)" t MSG_167 "Memasang MBR yang membenarkan pilihan bo
Source: rufus-3.14p.exe	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: tellen (maakt een autorun.inf aan)" t MSG_167 "Installeert een MBR die een opstartselectie toestaat en de BIOS USB-drive ID kan verbergen" t MSG_168 "Probeert de eerste opstartbare USB drive (gewoonlijk 0x80) voor te laten doen als een andere schijf.\nDit is
Source: rufus-3.14p.exe	Binary or memory string: Check this box to allow the display of international labels and set a device icon (creates an autorun.inf)
Source: rufus-3.14p.exe	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: t perangkat bootable" t MSG_165 "Klik untuk memilih sebuah image..." t MSG_166 "Centang kotak ini untuk menampilkan label internasional dan menyetel ikon perangkat (membuat autorun.inf)" t MSG_167 "Menginstal MBR memungkinkan untuk boot dan dapat memanipula
Source: rufus-3.14p.exe	Binary or memory string: . (autorun.inf .)" t MSG_167 " MBR BIO
Source: rufus-3.14p.exe	Binary or memory string: (creates an autorun.inf)" t MSG_167 "Install an MBR that allows boot selection and can masquerade the BIOS USB drive ID" t MSG_168 "Try to masquerade first bootable USB drive (usually 0x80) as a different disk.\n" "This should only be necessary if you inst
Source: rufus-3.14p.exe	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: [autorun]icon = autorun.icolabel = %s
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	Binary or memory string: Check this box to allow the display of international labels and set a device icon (creates an autorun.inf)$
Source: rufus-3.14p.exe, 00000000.00000002.928580187.00000000034E0000.00000004.00000001.sdmp	Binary or memory string: Check this box to allow the display of international labels and set a device icon (creates an autorun.inf)>
Source: rufus-3.14p.exe, 00000000.00000002.927433503.0000000000E1B000.00000040.00020000.sdmp	Binary or memory string: Check the device for bad blocks using a test patternUncheck this box to use the "slow" format methodMethod that will be used to make the drive bootableClick to select or download an image...Check this box to allow the display of international labels and set a device icon (creates an autorun.inf)Install an MBR that allows boot selection and can masquerade the BIOS USB drive IDTry to masquerade first bootable USB drive (usually 0x80) as a different disk.
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: "and set a device icon (creates an autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Potvrdite ovo da dozvolite prikaz internacijonalnih oznaka i napravite ikonu (stvara autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: m souboru autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: lg denne mulighed for at tillade visning af internationale etiketter og skabe et enheds-ikon (opretter en autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Aanvinken om weergave van internationale labels toe te laten en een apparaat-pictogram in te stellen (maakt een autorun.inf aan)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: misen ja asettaaksesi laitekuvakkeen (luo autorun.inf-tiedoston)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: e un fichier autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: tesymbol zu erzeugen (autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: hoz (egy autorun.inf f
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Centang kotak ini untuk menampilkan label internasional dan menyetel ikon perangkat (membuat autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: un file autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: . (autorun.inf
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: ces ikonas izveidei (tiek izveidots fails autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: (sukuria autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Klik kotak ini untuk membenarkan paparan label antarabangsa dan menetapkan ikon cakera (akan membuat fail autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: tillate visning av internasjonal merkelapp og lage et stasjonsikon (lager en autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: autorun.inf"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: dzenia (tworzy plik autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: cone para a unidade (cria um arquivo autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: cone para a unidade (cria um ficheiro autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: ier autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: uje autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: boru autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: iti prikaz \"mednarodnih\" oznak nosilca in nastaviti ikono za napravo (to ustvari datoteko autorun.inf)."
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: n para permitir que se muestren caracteres internacionales y establecer un icono para la unidad (crea un archivo autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: tta en enhetsikon (en autorun.inf skapas)"
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t simgesini belirleyin (autorun.inf olu
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t autorun.inf)"
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: NtQueryVolumeInformationFileGetLogicalDriveStrings failed: %sGetLogicalDriveStrings: Buffer too small (required %d vs. %d)\\.\%c:\\.\#:Failed to get a drive letterNo drive letter was assigned...ABORTED: Cannot use an image that is located on the target drive!Failed to delete mountpoint %s: %sNO_LABELNo medialabelIgnoring autorun.inf label for drive %c: %sUsing autorun.inf label for drive %c: '%s'#:\autorun.inf%s does not have a Boot Marker%s has a %s Master Boot Record%s has an unknown Master Boot RecordPartition Boot RecordVolume does not have an x86 %sDrive has a %s %sVolume has an unknown FAT16 or FAT32 %sVolume has an unknown %sCould not unmount drive: %sCould not mount %s as %C:%s was successfully mounted as %C:%s is already mounted, but volume GUID could not be checked: %s%s is mounted, but volume GUID doesn't match:
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: @FATLarge FAT32Invalid logical volume handleIOCTL_DISK_GET_DRIVE_GEOMETRY error: %sFailed to get device geometry (both regular and _ex)IOCTL_DISK_GET_PARTITION_INFO error: %sFailed to get partition info (both regular and _ex)This drive is too small for FAT32 - there must be at least 64K clustersThis drive is too big for FAT32 - max 2TB supportedFailed to allocate memoryformat_fat32.cSectorsPerCluster > 0This drive has more than 2^28 clusters, try to specify a larger cluster size or use the defaultFAT32 must have at least 65536 clusters, try to specify a smaller cluster size or use the defaultThis drive is too big for large FAT32 formatSize : %s %u sectorsCluster size %d bytes, %d bytes per sectorVolume ID is %x:%x%d Reserved sectors, %d sectors per FAT, %d FATs%d Total clusters%d Free clustersClearing out %d sectors for reserved sectors, FATs and root cluster...Error clearing reserved sectorsInitializing reserved sectors and FATs...FAT #%d sector at address: %dCould not write partition boot record - drive may not boot...Setting label...Could not set label: %sFormat completed.NO NAME iconUnable to create icon '%s': %s.Could not write icon header: %s.Could not write ICONDIRENTRY[%d]: %s.Could not write ICONDIRENTRY[%d] offset: %s.Could not write icon data #%d: %s.Created: %s%sautorun.infr%s already exists - keeping itw, ccs=UTF-16LEUnable to create %sNOTE: This may be caused by a poorly designed security solution. See https://goo.gl/QTobxX.; Created by %s
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: [autorun]
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: Error allocating file name%s%s/%srufus_files%s/syslinux-%s/%s Replaced with local version %s Could not replace file: %s File name sanitized to '%s' Unable to create file: %sautorun.inf NOTE: This is usually caused by a poorly designed security solution. See https://goo.gl/QTobxX.
Source: rufus-3.14p.exe	Binary or memory string: Using autorun.inf label for drive %c: '%s'
Source: rufus-3.14p.exe	Binary or memory string: #:\autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: Ignoring autorun.inf label for drive %c: %s
Source: rufus-3.14p.exe	Binary or memory string: %sautorun.inf
Source: rufus-3.14p.exe	Binary or memory string: [autorun] icon = autorun.ico label = %s
Source: rufus-3.14p.exe	Binary or memory string: buat cakera boot" t MSG_165 "Klik untuk memilih atau memuat turun imej..." t MSG_166 "Klik kotak ini untuk membenarkan paparan label antarabangsa dan menetapkan ikon cakera (akan membuat fail autorun.inf)" t MSG_167 "Memasang MBR yang membenarkan pilihan bo
Source: rufus-3.14p.exe	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: tellen (maakt een autorun.inf aan)" t MSG_167 "Installeert een MBR die een opstartselectie toestaat en de BIOS USB-drive ID kan verbergen" t MSG_168 "Probeert de eerste opstartbare USB drive (gewoonlijk 0x80) voor te laten doen als een andere schijf.\nDit is
Source: rufus-3.14p.exe	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: t perangkat bootable" t MSG_165 "Klik untuk memilih sebuah image..." t MSG_166 "Centang kotak ini untuk menampilkan label internasional dan menyetel ikon perangkat (membuat autorun.inf)" t MSG_167 "Menginstal MBR memungkinkan untuk boot dan dapat memanipula
Source: rufus-3.14p.exe	Binary or memory string: . (autorun.inf .)" t MSG_167 " MBR BIO
Source: rufus-3.14p.exe	Binary or memory string: (creates an autorun.inf)" t MSG_167 "Install an MBR that allows boot selection and can masquerade the BIOS USB drive ID" t MSG_168 "Try to masquerade first bootable USB drive (usually 0x80) as a different disk.\n" "This should only be necessary if you inst
Source: rufus-3.14p.exe	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe	Binary or memory string: [autorun]icon = autorun.icolabel = %s
Source: rufus-3.14p.exe, 00000001.00000002.685637329.0000000003260000.00000004.00000001.sdmp	Binary or memory string: Check this box to allow the display of international labels and set a device icon (creates an autorun.inf)
Source: rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: NtQueryVolumeInformationFileGetLogicalDriveStrings failed: %sGetLogicalDriveStrings: Buffer too small (required %d vs. %d)\\.\%c:\\.\#:Failed to get a drive letterNo drive letter was assigned...ABORTED: Cannot use an image that is located on the target drive!Failed to delete mountpoint %s: %sNO_LABELNo medialabelIgnoring autorun.inf label for drive %c: %sUsing autorun.inf label for drive %c: '%s'#:\autorun.inf%s does not have a Boot Marker%s has a %s Master Boot Record%s has an unknown Master Boot RecordPartition Boot RecordVolume does not have an x86 %sDrive has a %s %sVolume has an unknown FAT16 or FAT32 %sVolume has an unknown %sCould not unmount drive: %sCould not mount %s as %C:%s was successfully mounted as %C:%s is already mounted, but volume GUID could not be checked: %s%s is mounted, but volume GUID doesn't match:
Source: rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: @FATLarge FAT32Invalid logical volume handleIOCTL_DISK_GET_DRIVE_GEOMETRY error: %sFailed to get device geometry (both regular and _ex)IOCTL_DISK_GET_PARTITION_INFO error: %sFailed to get partition info (both regular and _ex)This drive is too small for FAT32 - there must be at least 64K clustersThis drive is too big for FAT32 - max 2TB supportedFailed to allocate memoryformat_fat32.cSectorsPerCluster > 0This drive has more than 2^28 clusters, try to specify a larger cluster size or use the defaultFAT32 must have at least 65536 clusters, try to specify a smaller cluster size or use the defaultThis drive is too big for large FAT32 formatSize : %s %u sectorsCluster size %d bytes, %d bytes per sectorVolume ID is %x:%x%d Reserved sectors, %d sectors per FAT, %d FATs%d Total clusters%d Free clustersClearing out %d sectors for reserved sectors, FATs and root cluster...Error clearing reserved sectorsInitializing reserved sectors and FATs...FAT #%d sector at address: %dCould not write partition boot record - drive may not boot...Setting label...Could not set label: %sFormat completed.NO NAME iconUnable to create icon '%s': %s.Could not write icon header: %s.Could not write ICONDIRENTRY[%d]: %s.Could not write ICONDIRENTRY[%d] offset: %s.Could not write icon data #%d: %s.Created: %s%sautorun.infr%s already exists - keeping itw, ccs=UTF-16LEUnable to create %sNOTE: This may be caused by a poorly designed security solution. See https://goo.gl/QTobxX.; Created by %s
Source: rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: [autorun]
Source: rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: Error allocating file name%s%s/%srufus_files%s/syslinux-%s/%s Replaced with local version %s Could not replace file: %s File name sanitized to '%s' Unable to create file: %sautorun.inf NOTE: This is usually caused by a poorly designed security solution. See https://goo.gl/QTobxX.
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: "and set a device icon (creates an autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Potvrdite ovo da dozvolite prikaz internacijonalnih oznaka i napravite ikonu (stvara autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: m souboru autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: lg denne mulighed for at tillade visning af internationale etiketter og skabe et enheds-ikon (opretter en autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Aanvinken om weergave van internationale labels toe te laten en een apparaat-pictogram in te stellen (maakt een autorun.inf aan)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: misen ja asettaaksesi laitekuvakkeen (luo autorun.inf-tiedoston)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: e un fichier autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: tesymbol zu erzeugen (autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: hoz (egy autorun.inf f
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Centang kotak ini untuk menampilkan label internasional dan menyetel ikon perangkat (membuat autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: un file autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: . (autorun.inf
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: ces ikonas izveidei (tiek izveidots fails autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: (sukuria autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t MSG_166 "Klik kotak ini untuk membenarkan paparan label antarabangsa dan menetapkan ikon cakera (akan membuat fail autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: tillate visning av internasjonal merkelapp og lage et stasjonsikon (lager en autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: autorun.inf"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: dzenia (tworzy plik autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: cone para a unidade (cria um arquivo autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: cone para a unidade (cria um ficheiro autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: ier autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: uje autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: boru autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: iti prikaz \"mednarodnih\" oznak nosilca in nastaviti ikono za napravo (to ustvari datoteko autorun.inf)."
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: n para permitir que se muestren caracteres internacionales y establecer un icono para la unidad (crea un archivo autorun.inf)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: tta en enhetsikon (en autorun.inf skapas)"
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: autorun.inf
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t simgesini belirleyin (autorun.inf olu
Source: rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	Binary or memory string: t autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: "and set a device icon (creates an autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_166 "Potvrdite ovo da dozvolite prikaz internacijonalnih oznaka i napravite ikonu (stvara autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: m souboru autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: lg denne mulighed for at tillade visning af internationale etiketter og skabe et enheds-ikon (opretter en autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_166 "Aanvinken om weergave van internationale labels toe te laten en een apparaat-pictogram in te stellen (maakt een autorun.inf aan)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: misen ja asettaaksesi laitekuvakkeen (luo autorun.inf-tiedoston)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: e un fichier autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: tesymbol zu erzeugen (autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: hoz (egy autorun.inf f
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_166 "Centang kotak ini untuk menampilkan label internasional dan menyetel ikon perangkat (membuat autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: un file autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: autorun.inf
Source: Ruf5D27.tmp.0.dr	Binary or memory string: . (autorun.inf
Source: Ruf5D27.tmp.0.dr	Binary or memory string: ces ikonas izveidei (tiek izveidots fails autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: (sukuria autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_166 "Klik kotak ini untuk membenarkan paparan label antarabangsa dan menetapkan ikon cakera (akan membuat fail autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: tillate visning av internasjonal merkelapp og lage et stasjonsikon (lager en autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: autorun.inf"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: dzenia (tworzy plik autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: cone para a unidade (cria um arquivo autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: cone para a unidade (cria um ficheiro autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: ier autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: uje autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: boru autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: iti prikaz \"mednarodnih\" oznak nosilca in nastaviti ikono za napravo (to ustvari datoteko autorun.inf)."
Source: Ruf5D27.tmp.0.dr	Binary or memory string: n para permitir que se muestren caracteres internacionales y establecer un icono para la unidad (crea un archivo autorun.inf)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: tta en enhetsikon (en autorun.inf skapas)"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: autorun.inf
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t simgesini belirleyin (autorun.inf olu
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t autorun.inf)"

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D1FC08 GetLogicalDriveStringsA,strlen,isalpha,toupper,

Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 185.199.109.154 185.199.109.154

Source: Joe Sandbox View

JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D330C4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InternetCrackUrlA,strlen,InternetCrackUrlA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,SetLastError,HttpQueryInfoA,_atoi64,_snprintf,calloc,InternetReadFile,WriteFile,GetLastError,FlushFileBuffers,CloseHandle,??3@YAXPAX@Z,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,SetLastError,

Source: unknown

DNS traffic detected: queries for: rufus.ie

Source: rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.di
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceTLSHybridECCSHA2562020CA1.crt0
Source: rufus-3.14p.exe, 00000000.00000003.926699047.0000000007A3D000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: rufus-3.14p.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: rufus-3.14p.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl00
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceTLSHybridECCSHA2562020CA1.crl0Q
Source: rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceTLSHybridECCSHA2562020CA1.crl0
Source: rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: http://e2fsprogs.sourceforge.net/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	String found in binary or memory: http://freedos.sourceforge.net/freecom
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: http://fsf.org/
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp, Ruf5D27.tmp.0.dr	String found in binary or memory: http://halamix2.pl
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: http://ms-sys.sourceforge.net/
Source: rufus-3.14p.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0M
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0Z
Source: rufus-3.14p.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: rufus-3.14p.exe	String found in binary or memory: http://s.symcd.com06
Source: rufus-3.14p.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: rufus-3.14p.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: rufus-3.14p.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: rufus-3.14p.exe, 00000000.00000002.941087603.0000000007A18000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: http://www.ridgecrop.demon.co.uk/index.htm?fat32format.htm
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://7-zip.org/
Source: rufus-3.14p.exe, 00000000.00000003.926898680.0000000007A22000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000003.693919903.0000000007A42000.00000004.00000001.sdmp	String found in binary or memory: https://api.github.com/_private/browser/errors
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://axialis.com/
Source: rufus-3.14p.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: rufus-3.14p.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: rufus-3.14p.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: rufus-3.14p.exe, 00000000.00000003.693919903.0000000007A42000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.941100440.0000000007A1B000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.941062881.0000000007A10000.00000004.00000001.sdmp	String found in binary or memory: https://github-releases.githubusercontent.com/165325376/fafe6000-62a6-11eb-97b7-11f2cc17770a?X-Amz-A
Source: rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp, Ruf5D27.tmp.0.dr	String found in binary or memory: https://github.com/Chocobo1
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/chenall/grub4dos
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/kokke/tiny-regex-c
Source: rufus-3.14p.exe	String found in binary or memory: https://github.com/pbatard/Fido
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, Fido[1].ver.0.dr	String found in binary or memory: https://github.com/pbatard/Fido/releases/download/v1.11/Fido.ps1
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp, Fido[1].ver.0.dr	String found in binary or memory: https://github.com/pbatard/Fido/releases/download/v1.18/Fido.ps1.lzma
Source: rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp	String found in binary or memory: https://github.com/pbatard/Fido/releases/download/v1.18/Fido.ps1.lzma8
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/pbatard/bled
Source: rufus-3.14p.exe	String found in binary or memory: https://github.com/pbatard/rufus/blob/master/res/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000000.00000002.927433503.0000000000E1B000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684579001.0000000000E24000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/blob/master/res/loc/ChangeLog.txt
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/issues
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp, Rufus_win[1].ver.0.dr	String found in binary or memory: https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14.exe
Source: rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14.exe6
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14.exedownload_url_arm
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, Rufus_win[1].ver.0.dr	String found in binary or memory: https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm.exe
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm.exedownload_url_arm64
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, Rufus_win[1].ver.0.dr	String found in binary or memory: https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm64.exe
Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm64.exerelease_notes
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/wiki/FAQ#BSODs_with_Windows_To_Go_drives_created_from_Windows_10_18
Source: rufus-3.14p.exe	String found in binary or memory: https://github.com/pbatard/rufus/wiki/FAQ#Why_do_I_need_to_disable_Secure_Boot_to_use_UEFINTFS
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/pbatard/rufus/wiki/FAQ#Why_do_I_need_to_disable_Secure_Boot_to_use_UEFINTFSSecure
Source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/pbatard/uefi-ntfs.
Source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/pbatard/uefi-ntfs.MZ
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://github.com/weidai11/cryptopp/
Source: rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://goo.gl/QTobxX.
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://goo.gl/QTobxX.;
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://kolibrios.org/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://processhacker.sourceforge.io/
Source: rufus-3.14p.exe	String found in binary or memory: https://rufus.ie
Source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp	String found in binary or memory: https://rufus.ie).
Source: rufus-3.14p.exe	String found in binary or memory: https://rufus.ie/
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://rufus.ie/CheckForBetashttps://rufus.ieUsing
Source: rufus-3.14p.exe	String found in binary or memory: https://rufus.ie/Fido.ver
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://rufus.ie/Fido.verz1https://github.com/pbatard/FidoWARNING:
Source: rufus-3.14p.exe	String found in binary or memory: https://rufus.ie/files
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://rufus.ie/files%s/%s-%s/%sGrub2%s
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://rufus.ie321Failed
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://sourceforge.net/projects/smartmontools
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://svn.reactos.org/reactos/trunk
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://svn.reactos.org/reactos/trunk/reactos/dll/win32/fmifs
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://syslinux.org/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://tortoisegit.org/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://tortoisesvn.net/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://winscp.net/
Source: rufus-3.14p.exe	String found in binary or memory: https://www.7-zip.org
Source: rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.7-zip.orgopenESP2.04rufus_filescore.imggrub%s-%s/%srbWill
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.busybox.net/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.codeguru.com/forum/showthread.php?p=1951973
Source: rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.freedos.org/
Source: rufus-3.14p.exe	String found in binary or memory: https://www.gnu.org/licenses/gpl-3.0.htmlF
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.gnu.org/software/fdisk
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.gnu.org/software/grub
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.gnu.org/software/libcdio
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.gnu.org/software/wget
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.gnupg.org/
Source: rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	String found in binary or memory: https://www.reactos.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.154:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D3A1E7 CryptAcquireContextW,CryptImportKey,CryptCreateHash,CryptHashData,CryptVerifySignatureW,CryptDestroyHash,CryptReleaseContext,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D3BA0A GetProcAddress,GetProcAddress,GetProcAddress,NtOpenProcessToken,NtAdjustPrivilegesToken,NtClose,_snprintf,strlen,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D1DFC6: CreateFileA,DeviceIoControl,CloseHandle,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D37278
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D33C45
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D210EE
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D91080
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D7F00C
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D119D5
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D8718D
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D2F287
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D2B20C
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D2ECA4
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D24C5F
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D12FD6
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D12794
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D37278
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D210EE
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D91080
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D2ECA4
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D24C5F
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D7F00C
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D119D5
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D8718D
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D2F287
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D2B20C
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D12794

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\rufus.com 5F819F6EAE4B5845C082EDF14CB389AB9805BC3C17440F3B5398D4FDD0079FFE

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Process token adjusted: Load Driver

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: String function: 00D4C592 appears 1523 times

Source: rufus-3.14p.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: rufus-3.14p.exe, 00000000.00000002.940474323.00000000071F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamecomdlg32.dll.muij% vs rufus-3.14p.exe
Source: rufus-3.14p.exe, 00000000.00000002.941022311.00000000077C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs rufus-3.14p.exe
Source: rufus-3.14p.exe, 00000000.00000002.928704808.0000000003720000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameimageres.DLLj% vs rufus-3.14p.exe
Source: rufus-3.14p.exe, 00000000.00000002.927259489.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs rufus-3.14p.exe
Source: rufus-3.14p.exe, 00000000.00000002.935781734.0000000005040000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameOLEACCRC.DLLj% vs rufus-3.14p.exe
Source: rufus-3.14p.exe, 00000000.00000000.662105062.0000000001057000.00000008.00020000.sdmp	Binary or memory string: OriginalFilenamerufus-3.14.exe, vs rufus-3.14p.exe
Source: rufus-3.14p.exe, 00000001.00000002.683961357.00000000003F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs rufus-3.14p.exe
Source: rufus-3.14p.exe, 00000001.00000000.665664079.0000000001057000.00000008.00020000.sdmp	Binary or memory string: OriginalFilenamerufus-3.14.exe, vs rufus-3.14p.exe
Source: rufus-3.14p.exe	Binary or memory string: OriginalFilenamerufus-3.14.exe, vs rufus-3.14p.exe

Source: rufus-3.14p.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED

Source: rufus-3.14p.exe

Static PE information: Section: UPX1 ZLIB complexity 0.99911067827

Source: classification engine

Classification label: mal42.spre.evad.winEXE@2/11@3/3

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D4CBB9 GetLastError,_snprintf,strlen,calloc,FormatMessageW,GetLastError,WideCharToMultiByte,??3@YAXPAX@Z,SetLastError,SetLastError,GetLastError,_snprintf,SetLastError,_snprintf,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D4B7B9 FindResourceA,LoadResource,SizeofResource,calloc,LockResource,LockResource,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File created: C:\Users\user\Desktop\rufus.com

Jump to behavior

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global/Rufus
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global/Rufus_CmdLine

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File created: C:\Users\user\AppData\Local\Temp\Ruf5D27.tmp

Jump to behavior

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File read: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\rufus-3.14p.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\rufus-3.14p.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: rufus-3.14p.exe	String found in binary or memory: gen worden als het bestand al bestaat. Als er geen bestand online wordt gevonden, dan zal de standaard versie worden gebruikt." t MSG_117 "Standaard Windows-installatie" t MSG_119 "Geavanceerde eigenschappen van drive" t MSG_120 "Geavanceerde opties voor fo
Source: rufus-3.14p.exe	String found in binary or memory: :size Sets maximum size of line edit buffer (default:128) /MACROS Displays all DOSKey macros /OVERSTRIKE Overwrites new characters onto line when typing (default) /REINSTALL Installs a new copy of DOSKey macroname Specifie
Source: rufus-3.14p.exe	String found in binary or memory: the command to carry out for each file. command-parameters Specifies parameters or switches for the specified command. To use the FOR command in a batch program, specify %%variable instead of %variable. For example: FOR %f IN (---start--- a*
Source: rufus-3.14p.exe	String found in binary or memory: /boot/x86_64/loader/isolinux.cfg
Source: rufus-3.14p.exe	String found in binary or memory: /boot/i386/loader/isolinux.cfg
Source: rufus-3.14p.exe	String found in binary or memory: -h, --help
Source: rufus-3.14p.exe	String found in binary or memory: -h, --help
Source: rufus-3.14p.exe	String found in binary or memory: chten:" t MSG_132 "Ein anderer Prozess bzw. ein anderes Programm verwendet das Laufwerk gerade. Wollen Sie es trotzdem formatieren?" t MSG_133 "Rufus hat erkannt, dass Sie ein 'Windows To Go'-Startmedium, basierend auf Windows 10 Version 1809, erstellen woll
Source: rufus-3.14p.exe	String found in binary or memory: gen worden als het bestand al bestaat. Als er geen bestand online wordt gevonden, dan zal de standaard versie worden gebruikt." t MSG_117 "Standaard Windows-installatie" t MSG_119 "Geavanceerde eigenschappen van drive" t MSG_120 "Geavanceerde opties voor fo
Source: rufus-3.14p.exe	String found in binary or memory: :size Sets maximum size of line edit buffer (default:128) /MACROS Displays all DOSKey macros /OVERSTRIKE Overwrites new characters onto line when typing (default) /REINSTALL Installs a new copy of DOSKey macroname Specifie
Source: rufus-3.14p.exe	String found in binary or memory: the command to carry out for each file. command-parameters Specifies parameters or switches for the specified command. To use the FOR command in a batch program, specify %%variable instead of %variable. For example: FOR %f IN (---start--- a*
Source: rufus-3.14p.exe	String found in binary or memory: /boot/x86_64/loader/isolinux.cfg
Source: rufus-3.14p.exe	String found in binary or memory: /boot/i386/loader/isolinux.cfg
Source: rufus-3.14p.exe	String found in binary or memory: -h, --help
Source: rufus-3.14p.exe	String found in binary or memory: -h, --help
Source: rufus-3.14p.exe	String found in binary or memory: chten:" t MSG_132 "Ein anderer Prozess bzw. ein anderes Programm verwendet das Laufwerk gerade. Wollen Sie es trotzdem formatieren?" t MSG_133 "Rufus hat erkannt, dass Sie ein 'Windows To Go'-Startmedium, basierend auf Windows 10 Version 1809, erstellen woll

Source: unknown	Process created: C:\Users\user\Desktop\rufus-3.14p.exe 'C:\Users\user\Desktop\rufus-3.14p.exe'
Source: unknown	Process created: C:\Users\user\Desktop\rufus-3.14p.exe 'C:\Users\user\Desktop\rufus-3.14p.exe'

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File written: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Window detected: Number of UI elements: 28
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Window detected: Number of UI elements: 33

Source: rufus-3.14p.exe

Static PE information: certificate valid

Source: rufus-3.14p.exe

Static file information: File size 1173560 > 1048576

Source: rufus-3.14p.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x112400

Source: rufus-3.14p.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Projects\uefi-ntfs\arm\Release\bootarm.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp
Source:	Binary string: C:\Projects\uefi-ntfs\aa64\Release\bootaa64.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp
Source:	Binary string: C:\Projects\uefi-ntfs\ia32\Release\bootia32.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp
Source:	Binary string: C:\Projects\uefi-ntfs\x64\Release\bootx64.pdb source: rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D114F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D330C4 push edi; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D36009 push edx; mov dword ptr [esp], edi
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D36009 push ecx; mov dword ptr [esp], esi
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D5515B push eax; mov dword ptr [esp], 00000C4Dh
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D4BDE7 push ecx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D2C058 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D291E2 push dword ptr [esp+ebx-18h]; retf
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D2F287 push eax; mov dword ptr [esp], esi
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D2B20C push eax; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D24C5F push ecx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D24C5F push edx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D506ED push eax; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D16EB5 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D16EB5 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D16EB5 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D16EB5 push ecx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D16EB5 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D16EB5 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D17639 push ecx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D17639 push edx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D3B729 push edx; mov dword ptr [esp], 00DA8514h
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D2C058 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D24C5F push ecx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D24C5F push edx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D4BDE7 push ecx; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D5515B push eax; mov dword ptr [esp], 00000C4Dh
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D506ED push eax; mov dword ptr [esp], ebx
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D2F287 push eax; mov dword ptr [esp], esi
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D16EB5 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D16EB5 push edx; mov dword ptr [esp], eax
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D16EB5 push edx; mov dword ptr [esp], eax

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior:

Drops PE files with a suspicious file extension

Show sources

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File created: C:\Users\user\Desktop\rufus.com

Jump to dropped file

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File created: C:\Users\user\Desktop\rufus.com

Jump to dropped file

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Section loaded: OutputDebugStringW count: 126

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D19332 strstr,_strnicmp,strlen,strlen,strstr,strlen,strstr,SetupDiGetDeviceInstanceIdA,SetupDiGetDeviceRegistryPropertyA,strlen,strlen,strlen,strlen,??3@YAXPAX@Z,SetupDiEnumDeviceInterfaces,GetLastError,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Dropped PE file which has not been started: C:\Users\user\Desktop\rufus.com

Jump to dropped file

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\rufus-3.14p.exe	API coverage: 4.2 %
Source: C:\Users\user\Desktop\rufus-3.14p.exe	API coverage: 1.2 %

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D1FC08 GetLogicalDriveStringsA,strlen,isalpha,toupper,

Source: rufus-3.14p.exe	Binary or memory string: VMware__VMware_Virtual_S
Source: rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: \\?\GLOBALROOTSuper Floppy DiskAndroid Boot PartitionAndroid Bootloader PartitionAndroid Cache PartitionAndroid Config PartitionAndroid Data PartitionAndroid Ext PartitionAndroid Factory PartitionAndroid Fastboot PartitionAndroid Metadata PartitionAndroid Misc PartitionAndroid OEM PartitionAndroid Persistent PartitionAndroid Recovery PartitionAndroid System PartitionAndroid Vendor PartitionApple APFS PartitionApple Boot PartitionApple Filevault PartitionApple HFS+ PartitionApple Label PartitionApple RAID Partition (Offline)Apple RAID PartitionApple RAID Cache PartitionApple RAID Scratch PartitionApple RAID Status PartitionApple RAID Volume PartitionApple Recovery PartitionApple UFS PartitionApple ZFS PartitionAtari Data PartitionBeOS BFS PartitionChrome OS Kernel PartitionChrome OS Reserved PartitionChrome OS Root PartitionCoreOS Raid PartitionCoreOS Reserved PartitionCoreOS Root PartitionCoreOS Usr PartitionFreeBSD Boot PartitionFreeBSD Data PartitionFreeBSD LVM PartitionFreeBSD Swap PartitionFreeBSD UFS PartitionFreeBSD ZFS PartitionBIOS Boot PartitionExtended Boot Loader PartitionEFI System PartitionMBR PartitionUnused PartitionHP-UX Data PartitionHP-UX Service PartitionIBM GPFS PartitionIntel Fast Flash PartitionLenovo Boot PartitionLinux Boot PartitionLinux Data PartitionLinux Encrypted PartitionLinux Home PartitionLinux LUKS PartitionLinux LVM PartitionLinux RAID PartitionLinux Reserved PartitionLinux Boot Partition (ARM)Linux Boot Partition (ARM64)Linux Boot Partition (x86-32)Linux Boot Partition (x86-64)Linux Srv PartitionLinux Swap PartitionMicrosoft Basic Data PartitionMicrosoft LDM Data PartitionMicrosoft LDM Metadata PartitionMicrosoft Recovery PartitionMicrosoft System Reserved PartitionMicrosoft Storage Spaces PartitionNetBSD Concatenated PartitionNetBSD Encrypted PartitionNetBSD FFS PartitionNetBSD LFS PartitionNetBSD RAID PartitionNetBSD Swap PartitionOpenBSD Data PartitionPlan 9 Data PartitionPReP Boot PartitionQNX Data PartitionSolaris Alternate Sector PartitionSolaris Backup PartitionSolaris Boot PartitionSolaris Home PartitionSolaris Reserved PartitionSolaris Root PartitionSolaris Swap PartitionSolaris Var PartitionSony Boot PartitionVeraCrypt Data PartitionVMware Coredump PartitionVMware Reserved PartitionVMware VMFS PartitionEmptyFAT12XENIX rootXENIX usrSmall FAT16ExtendedFAT16NTFS/exFAT/UDFAIXAIX BootableOS/2 Boot ManagerFAT32FAT32 LBAFAT16 LBAExtended LBAOPUSHidden FAT12Compaq DiagnosticsHidden Small FAT16Hidden FAT16Hidden NTFSAST SmartSleepHidden FAT32Hidden FAT32 LBAHidden FAT16 LBAWindows Mobile XIPSpeedStorNEC DOSWindows Mobile IMGFSHidden NTFS WinREPlan 9PMagic RecoveryVenix 80286PPC PReP BootSFSQNX4.xOnTrack DMCP/MEZ DriveGolden BowPriam EDiskGNU HURD/SysVNetwareDiskSecure MultiBootPC/IXNovellXOSLF.I.X.AODPSMinixGNU/Linux SwapGNU/LinuxWindows HibernationGNU/Linux ExtendedNTFS Volume SetGNU/Linux PlaintextFreeDOS Hidden FAT12GNU/Linux LVMFreeDOS Hidden FAT16FreeDOS Hidden ExtendedGNU/Linux HiddenCHRP ISO-9660FreeDOS
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMware-Laufwerkserkennung"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "A detetar disco VMWare"
Source: rufus-3.14p.exe	Binary or memory string: dimensione CORRETTA" t MSG_264 "Eliminazione cartella '%s'" t MSG_265 "Rilevamento disco VMWare" t MSG_266 "Modo duale UEFI/BIOS" t MSG_267 "Applicazione immagine Windows: %s" t MSG_268 "Applicazione immagine Windows..." t MSG_269 "Preserva data/ora" t
Source: Ruf5D27.tmp.0.dr	Binary or memory string: w VMWare"
Source: rufus-3.14p.exe	Binary or memory string: VMware Coredump Partition
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare-levyn havaitseminen"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare-schijfdetectie"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "Deteksi VMWare disk"
Source: rufus-3.14p.exe	Binary or memory string: o NTFS" t MSG_261 "A criar imagem: %s" t MSG_262 "Suporte ISO" t MSG_263 "Usar unidade de tamanho APROPRIADO" t MSG_264 "A apagar pasta '%s'" t MSG_265 "A detetar disco VMWare" t MSG_266 "Modo duplo UEFI/BIOS" t MSG_267 "Aplicar imagem Windows: %s" t M
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "Detectare disc VMWare"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare disk detection"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMware lemez
Source: Ruf5D27.tmp.0.dr	Binary or memory string: tection de disque VMWare"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: o de disco VMWare"
Source: rufus-3.14p.exe	Binary or memory string: VMware Reserved Partition
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare detekce disk"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: vanie VMWare disku"
Source: rufus-3.14p.exe	Binary or memory string: " t MSG_264 " '%s'" t MSG_265 " VMWare" t MSG_266 "
Source: rufus-3.14p.exe	Binary or memory string: t MSG_260 "NTFS " t MSG_261 ": %s" t MSG_262 "ISO " t MSG_263 "" t MSG_264 " '%s'" t MSG_265 "VMWare " t MSG_266 "Dual
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "Zaznavanje diskov VMware"
Source: rufus-3.14p.exe, 00000001.00000002.685067045.000000000157B000.00000004.00000040.sdmp	Binary or memory string: VMWare disk detection
Source: rufus-3.14p.exe	Binary or memory string: okongan Rock Ridge" t MSG_259 "Paksa kemas kini" t MSG_260 "Mampatan NTFS" t MSG_261 "Menulis imej: %s" t MSG_262 "Sokongan ISO" t MSG_263 "Guna saiz seunit yang BETUL" t MSG_264 "Memadam direktori '%s'" t MSG_265 "Pengesanan cakera VMWare" t MSG_266 "
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "Pengesanan cakera VMWare"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: a VMWare"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare disk detektering"
Source: rufus-3.14p.exe	Binary or memory string: rrelsesenhet" t MSG_264 "Sletter mappe '%s'" t MSG_265 "VMWare-disk oppdagelse" t MSG_266 "Dobbel UEFI/BIOS-innstilling" t MSG_267 "Legger til Windows-bilde: %s" t MSG_268 "Legger til Windows-bilde..." t MSG_269 "Bevarer tidskode" t MSG_270 "USB-avkodin
Source: rufus-3.14p.exe, 00000000.00000002.928580187.00000000034E0000.00000004.00000001.sdmp	Binary or memory string: VMWare disk detectionDx
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "Rilevamento disco VMWare"
Source: rufus-3.14p.exe	Binary or memory string: t MSG_263 "Gunakan unit ukuran PROPER" t MSG_264 "Menghapus direktori '%s'" t MSG_265 "Deteksi VMWare disk" t MSG_266 "Modus Dual UEFI/BIOS" t MSG_267 "Menerapkan image Windows: %s" t MSG_268 "Menerapkan image Windows..." t MSG_269 "Pertahankan timestamp
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare diskdetekteringen
Source: rufus-3.14p.exe	Binary or memory string: VMware VMKCORE
Source: rufus-3.14p.exe	Binary or memory string: : %s" t MSG_262 "ISO " t MSG_263 "" t MSG_264 " '%s'" t MSG_265 "VMWare " t MSG_266 " UEFI/BIOS
Source: Ruf5D27.tmp.0.dr	Binary or memory string: n de discos VMWare"
Source: rufus-3.14p.exe	Binary or memory string: VMware VMFS
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare disk alg
Source: rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	Binary or memory string: USBSTORRTSUERCMIUCREUCRUASPSTORVUSBSTORETRONSTORASUSSTPTSCSISDPCISTORRTSORJMCRJMCFRIMMPTSKRIMSPTSKRISDRIXDPTSKTI21SONYESD7SKESM7SKO2MDO2SDVIACR_SD__SDHC__MMC__MS__MSPro__xDPicture__O2Media_USBUSB 1.0USB 1.1USB 2.0USB 3.0USB 3.1Arsenal_________Virtual_KernSafeVirtual_________Msft____Virtual_Disk____VMware__VMware_Virtual_SYou must wait at least 10 seconds before trying to reset a deviceThe device you are trying to reset does not appear to be a USB device...Could not open %s: %sCycling port %d (reset) on %s Failed to cycle port: %sPlease wait for the device to re-appear...<NULL>Could not get classes for device cycling: %sCould not cycle device (D1): %sCould not cycle device (D2): %sCould not cycle device (E1): %sCould not cycle device (E2): %sCould not find a device to cycle!SetupDiGetClassDevs (Interface) failed: %sSetupDiGetDeviceRegistryProperty (Friendly Name) failed: %sGeneric Optical DriveFound '%s' optical deviceSetupDiEnumDeviceInterfaces failed: %sUnable to allocate data for SP_DEVICE_INTERFACE_DETAIL_DATASetupDiGetDeviceInterfaceDetail (dummy) failed: %sSetupDiGetDeviceInterfaceDetail (dummy) - no data was allocatedSetupDiGetDeviceInterfaceDetail (actual) failed: %s[ID][GP])UAS (disk from which Rufus is runningsystem disk
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare-disk oppdagelse"
Source: rufus-3.14p.exe	Binary or memory string: w VMWare" t MSG_266 "Tryb dual UEFI/BIOS" t MSG_267 "Zastosowywanie obrazu Windows: %s" t MSG_268 "Zastosowywanie obrazu Windows..." t MSG_269 "Zachowaj znaczniki czasu" t MSG_270 "Debugowanie USB" t MSG_271 "Obliczanie sum kontrolnych obrazu: %s" t MSG
Source: Ruf5D27.tmp.0.dr	Binary or memory string: VMWare"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: VMWare
Source: rufus-3.14p.exe	Binary or memory string: t MSG_261 "Image schrijven: %s" t MSG_262 "ISO-ondersteuning" t MSG_263 "JUISTE grootte-eenheden gebruiken" t MSG_264 "Map '%s' verwijderen" t MSG_265 "VMWare-schijfdetectie" t MSG_266 "Dubbele UEFI/BIOS-modus" t MSG_267 "Windows-image toepassen: %s"
Source: rufus-3.14p.exe	Binary or memory string: sche Ordner '%s'" t MSG_265 "VMware-Laufwerkserkennung" t MSG_266 "Dualer UEFI/BIOS-Modus" t MSG_267 "Windows-Abbild aufspielen: %s" t MSG_268 "Windows-Abbild aufspielen..." t MSG_269 "Zeitstempel bewahren" t MSG_270 "USB-Testmodus" t MSG_271 "Berechne
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "Otkrivanje VMware diska"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: enje VMWare diska"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "VMWare disko aptikimas"
Source: Ruf5D27.tmp.0.dr	Binary or memory string: t MSG_265 "Noteikts VMWare disks"
Source: rufus-3.14p.exe	Binary or memory string: t MSG_260 "NTFS compression" t MSG_261 "Writing image: %s" t MSG_262 "ISO Support" t MSG_263 "Use PROPER size units" t MSG_264 "Deleting directory '%s'" t MSG_265 "VMWare disk detection" t MSG_266 "Dual UEFI/BIOS mode" t MSG_267 "Applying Windows image
Source: rufus-3.14p.exe	Binary or memory string: ttelse" t MSG_263 "MiB notation" t MSG_264 "Sletter mappen '%s'" t MSG_265 "VMWare disk detektering" t MSG_267 "Anvender Windows-image: %s" t MSG_268 "Anvender Windows-image..." t MSG_269 "Bevar tidsstempler" t MSG_271 "Beregner imagechecksumme: %s" t
Source: rufus-3.14p.exe	Binary or memory string: VMware VMFS Partition

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D114F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 0_2_00D111B3 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,_amsg_exit,_initterm,_cexit,exit,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: 1_2_00D111B3 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,_amsg_exit,_initterm,_cexit,exit,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D4C230 GetCurrentProcess,OpenProcessToken,GetTokenInformation,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,CloseHandle,

Source: rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: rufus-3.14p.exe, 00000000.00000002.928121172.0000000001B90000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rufus-3.14p.exe, 00000000.00000002.928121172.0000000001B90000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rufus-3.14p.exe, 00000000.00000002.928121172.0000000001B90000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetKeyboardLayoutNameA,sscanf,GetSystemDefaultLangID,GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,fputs,fputs,fprintf,strlen,strlen,strlen,strncat,fopen,fputs,fputs,fputs,fprintf,fprintf,fputs,fclose,strlen,strlen,strlen,strncat,fopen,fputs,fputs,fputs,fprintf,fputs,fprintf,fprintf,fprintf,fputs,fclose,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetKeyboardLayoutNameA,sscanf,GetSystemDefaultLangID,GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,fputs,fputs,fprintf,strlen,strlen,strlen,strncat,fopen,fputs,fputs,fputs,fprintf,fprintf,fputs,fclose,strlen,strlen,strlen,strncat,fopen,fputs,fputs,fputs,fprintf,fputs,fprintf,fprintf,fprintf,fputs,fclose,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,
Source: C:\Users\user\Desktop\rufus-3.14p.exe	Code function: GetOEMCP,GetUserDefaultUILanguage,GetLocaleInfoA,strcmp,strlen,strlen,strlen,strncat,fopen,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Code function: 0_2_00D33C45 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,Sleep,GetVersionExA,InternetCrackUrlA,_snprintf,InternetConnectA,??3@YAXPAX@Z,??3@YAXPAX@Z,_snprintf,strlen,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,InternetCloseHandle,HttpQueryInfoA,SystemTimeToFileTime,_snprintf,HttpQueryInfoA,calloc,InternetReadFile,_snprintf,??3@YAXPAX@Z,??3@YAXPAX@Z,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,Sleep,PostMessageW,RtlExitUserThread,_strtoi64,??3@YAXPAX@Z,_snprintf,GetSystemTime,SystemTimeToFileTime,

Source: C:\Users\user\Desktop\rufus-3.14p.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies Group Policy settings

Show sources

Source: C:\Users\user\Desktop\rufus-3.14p.exe

File written: C:\Windows\System32\GroupPolicy\GPT.INI

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Replication Through Removable Media11	Command and Scripting Interpreter2	LSASS Driver1	Process Injection2	Masquerading111	OS Credential Dumping	System Time Discovery1	Replication Through Removable Media11	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Native API2	Boot or Logon Initialization Scripts	LSASS Driver1	Virtualization/Sandbox Evasion1	LSASS Memory	Query Registry2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Security Software Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection2	NTDS	Virtualization/Sandbox Evasion1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information21	Cached Domain Credentials	Peripheral Device Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing11	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery24	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rufus-3.14p.exe	0%	Metadefender		Browse
rufus-3.14p.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\rufus.com	2%	Metadefender		Browse
C:\Users\user\Desktop\rufus.com	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://kolibrios.org/	0%	Avira URL Cloud	safe
https://rufus.ie).	0%	Avira URL Cloud	safe
https://rufus.ie/Fido.verz1https://github.com/pbatard/FidoWARNING:	0%	Avira URL Cloud	safe
https://rufus.ie/Fido.ver	0%	Avira URL Cloud	safe
http://www.ridgecrop.demon.co.uk/index.htm?fat32format.htm	0%	Avira URL Cloud	safe
http://cacerts.di	0%	Avira URL Cloud	safe
https://rufus.ie/CheckForBetashttps://rufus.ieUsing	0%	Avira URL Cloud	safe
https://rufus.ie/	0%	Avira URL Cloud	safe
https://rufus.ie	0%	Avira URL Cloud	safe
http://halamix2.pl	0%	Avira URL Cloud	safe
https://rufus.ie/files	0%	Avira URL Cloud	safe
https://axialis.com/	0%	Avira URL Cloud	safe
https://syslinux.org/	0%	Avira URL Cloud	safe
https://rufus.ie/files%s/%s-%s/%sGrub2%s	0%	Avira URL Cloud	safe
https://rufus.ie321Failed	0%	Avira URL Cloud	safe
https://www.7-zip.orgopenESP2.04rufus_filescore.imggrub%s-%s/%srbWill	0%	Avira URL Cloud	safe
https://github-releases.githubusercontent.com/165325376/fafe6000-62a6-11eb-97b7-11f2cc17770a?X-Amz-A	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
github.com	140.82.121.3	true	false	high
rufus.ie	185.199.110.153	true	false	unknown
github-releases.githubusercontent.com	185.199.109.154	true	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/pbatard/rufus/wiki/FAQ#Why_do_I_need_to_disable_Secure_Boot_to_use_UEFINTFSSecure	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://tortoisesvn.net/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm64.exe	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, Rufus_win[1].ver.0.dr	false		high
https://www.gnu.org/software/fdisk	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://www.gnu.org/software/grub	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://svn.reactos.org/reactos/trunk	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://www.busybox.net/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/rufus/blob/master/res/	rufus-3.14p.exe	false		high
https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14.exe6	rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp	false		high
https://processhacker.sourceforge.io/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://tortoisegit.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm64.exerelease_notes	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	false		high
https://kolibrios.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://winscp.net/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://svn.reactos.org/reactos/trunk/reactos/dll/win32/fmifs	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://www.gnu.org/licenses/gpl-3.0.htmlF	rufus-3.14p.exe	false		high
https://rufus.ie).	rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low
https://rufus.ie/Fido.verz1https://github.com/pbatard/FidoWARNING:	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://sourceforge.net/projects/smartmontools	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/weidai11/cryptopp/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
http://e2fsprogs.sourceforge.net/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/rufus/issues	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://www.gnupg.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
http://ms-sys.sourceforge.net/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://rufus.ie/Fido.ver	rufus-3.14p.exe	false	Avira URL Cloud: safe	unknown
https://www.reactos.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
http://www.ridgecrop.demon.co.uk/index.htm?fat32format.htm	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm.exe	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, Rufus_win[1].ver.0.dr	false		high
https://github.com/pbatard/uefi-ntfs.MZ	rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp	false		high
https://www.7-zip.org	rufus-3.14p.exe	false		high
https://github.com/pbatard/Fido/releases/download/v1.18/Fido.ps1.lzma8	rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp	false		high
http://cacerts.di	rufus-3.14p.exe, 00000000.00000003.926660595.0000000007A3A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://rufus.ie/CheckForBetashttps://rufus.ieUsing	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pbatard/rufus/wiki/FAQ#BSODs_with_Windows_To_Go_drives_created_from_Windows_10_18	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://rufus.ie/	rufus-3.14p.exe	false	Avira URL Cloud: safe	unknown
https://github.com/kokke/tiny-regex-c	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://rufus.ie	rufus-3.14p.exe	false	Avira URL Cloud: safe	unknown
http://halamix2.pl	rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp, Ruf5D27.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://www.gnu.org/software/wget	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://rufus.ie/files	rufus-3.14p.exe	false	Avira URL Cloud: safe	unknown
https://goo.gl/QTobxX.;	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://axialis.com/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.freedos.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/bled	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/rufus/blob/master/res/loc/ChangeLog.txt	rufus-3.14p.exe, rufus-3.14p.exe, 00000000.00000002.927433503.0000000000E1B000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684579001.0000000000E24000.00000040.00020000.sdmp	false		high
https://syslinux.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://rufus.ie/files%s/%s-%s/%sGrub2%s	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pbatard/Fido/releases/download/v1.18/Fido.ps1.lzma	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp, Fido[1].ver.0.dr	false		high
https://www.codeguru.com/forum/showthread.php?p=1951973	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://rufus.ie321Failed	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14.exe	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.928087831.000000000198B000.00000004.00000040.sdmp, Rufus_win[1].ver.0.dr	false		high
https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14.exedownload_url_arm	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	false		high
https://www.7-zip.orgopenESP2.04rufus_filescore.imggrub%s-%s/%srbWill	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low
https://github.com/pbatard/rufus/wiki/FAQ#Why_do_I_need_to_disable_Secure_Boot_to_use_UEFINTFS	rufus-3.14p.exe	false		high
https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm.exedownload_url_arm64	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp	false		high
https://github.com/pbatard/uefi-ntfs.	rufus-3.14p.exe, 00000000.00000002.927627582.0000000000FCA000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684900502.0000000000FCA000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/Fido	rufus-3.14p.exe	false		high
https://github.com/chenall/grub4dos	rufus-3.14p.exe, 00000000.00000002.927385472.0000000000D98000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/Chocobo1	rufus-3.14p.exe, 00000000.00000002.927466326.0000000000E37000.00000040.00020000.sdmp, rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp, Ruf5D27.tmp.0.dr	false		high
http://fsf.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
http://freedos.sourceforge.net/freecom	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684603529.0000000000E37000.00000040.00020000.sdmp	false		high
https://7-zip.org/	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://github.com/pbatard/Fido/releases/download/v1.11/Fido.ps1	rufus-3.14p.exe, 00000000.00000002.928591606.00000000034E8000.00000004.00000001.sdmp, Fido[1].ver.0.dr	false		high
https://goo.gl/QTobxX.	rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://www.gnu.org/software/libcdio	rufus-3.14p.exe, rufus-3.14p.exe, 00000001.00000002.684516397.0000000000D98000.00000040.00020000.sdmp	false		high
https://api.github.com/_private/browser/errors	rufus-3.14p.exe, 00000000.00000003.926898680.0000000007A22000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000003.693919903.0000000007A42000.00000004.00000001.sdmp	false		high
https://github-releases.githubusercontent.com/165325376/fafe6000-62a6-11eb-97b7-11f2cc17770a?X-Amz-A	rufus-3.14p.exe, 00000000.00000003.693919903.0000000007A42000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.941100440.0000000007A1B000.00000004.00000001.sdmp, rufus-3.14p.exe, 00000000.00000002.941062881.0000000007A10000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
140.82.121.3	github.com	United States	36459	GITHUBUS	false
185.199.109.154	github-releases.githubusercontent.com	Netherlands	54113	FASTLYUS	false
185.199.110.153	rufus.ie	Netherlands	54113	FASTLYUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	420143
Start date:	21.05.2021
Start time:	23:37:47
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	rufus-3.14p.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal42.spre.evad.winEXE@2/11@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 8.1% (good quality ratio 0.8%) Quality average: 4.6% Quality standard deviation: 12.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 52.184.81.210, 104.42.151.234, 13.64.90.137, 92.122.145.220, 20.82.210.154, 40.127.240.158, 52.155.217.156, 20.54.26.129, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, settings-win.data.microsoft.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, iris-de-prod-azsc-eas-b.eastasia.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, settingsfd-geo.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/420143/sample/rufus-3.14p.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
140.82.121.3	Secured fILE.js	Get hash	malicious	Browse
	INVOICE NO 070FT06.exe	Get hash	malicious	Browse
	Quoataion.jar	Get hash	malicious	Browse
	Remittance-E-MAIL-Layout-11_.jar	Get hash	malicious	Browse
	Remittance-E-MAIL-Layout-11_.jar	Get hash	malicious	Browse
	Quotation.jar	Get hash	malicious	Browse
	Signed Contract.jar	Get hash	malicious	Browse
	IMG_0124.jar	Get hash	malicious	Browse
	Signed Contract.jar	Get hash	malicious	Browse
	IMG_0124.jar	Get hash	malicious	Browse
	XPBPS2DL.exe	Get hash	malicious	Browse
	ATTACHED DRAWING AND SPECIFICATION.jar	Get hash	malicious	Browse
	Passport_ID_jpg.jar	Get hash	malicious	Browse
	shipment documents.jar	Get hash	malicious	Browse
	Ningbo-Bank Details.exe.exe	Get hash	malicious	Browse
	Signed Contract.jar	Get hash	malicious	Browse
	Remittance E-MAIL Layout - 10_.jar	Get hash	malicious	Browse
	F14 PO pdf.jar	Get hash	malicious	Browse
	F14 PO pdf.jar	Get hash	malicious	Browse
	Remittance E-MAIL Layout - 10_.jar	Get hash	malicious	Browse
185.199.109.154	ATTACHED DRAWING AND SPECIFICATION.jar	Get hash	malicious	Browse
	ATTACHED DRAWING AND SPECIFICATION.jar	Get hash	malicious	Browse
	Remittance E-MAIL Layout - 10_.jar	Get hash	malicious	Browse
	BANK DETAILS.jar	Get hash	malicious	Browse
	Bank payment copy.jar	Get hash	malicious	Browse
	Bank payment copy.jar	Get hash	malicious	Browse
	PL-REM-40310EMEA02 (0085).jar	Get hash	malicious	Browse
	DHL Notification.jar	Get hash	malicious	Browse
	EPC Works for AMAALA AIRFIELD PROJECT - WORK .jar	Get hash	malicious	Browse
	Payment Advice-BCS_ECS9522020090915390034_3159_952.jar	Get hash	malicious	Browse
	Purchase Order AMG 4530000463.jar	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Cerbu.95336.8410.exe	Get hash	malicious	Browse
	PO#5200668.jar	Get hash	malicious	Browse
	DHL SHIPPING DOCUMENT.jar	Get hash	malicious	Browse
	POM9433T-V_16-04-2021_pdf.zip.jar	Get hash	malicious	Browse
	Payment_Inv#0224-15-04-2021_pdf.jar	Get hash	malicious	Browse
	Telekom.jar	Get hash	malicious	Browse
	Pago 31 Mar 2021 at 2.15PP3343PDF.jar	Get hash	malicious	Browse
	ShowKeyPlus.exe	Get hash	malicious	Browse
	https://patrickphimr5.github.io/memoaideivozx/dsfriet.html?bbre=dxcfdgoiss	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
rufus.ie	rufus-3.13.exe	Get hash	malicious	Browse	185.199.108.153
	rufus_3-4_fr_430321.exe	Get hash	malicious	Browse	185.199.110.153
	rufus-3.13.exe	Get hash	malicious	Browse	185.199.109.153
	rufus_3-4_fr_430321.exe	Get hash	malicious	Browse	185.199.109.153
	rufus-3.13.exe	Get hash	malicious	Browse	185.199.111.153
	rufus-3.11.exe	Get hash	malicious	Browse	185.199.109.153
	rufus-3.4p.exe	Get hash	malicious	Browse	185.199.111.153
	rufus-portable-v3.10.exe	Get hash	malicious	Browse	185.199.111.153
	rufus-portable-v3.9.exe	Get hash	malicious	Browse	185.199.111.153
	rufus-3.9.exe	Get hash	malicious	Browse	185.199.108.153
	rufus-3.9.exe	Get hash	malicious	Browse	185.199.109.153
	https://github.com/pbatard/rufus/releases/download/v3.9/rufus-3.9.exe	Get hash	malicious	Browse	185.199.108.153
	rufus-3.9.exe	Get hash	malicious	Browse	185.199.111.153
	rufus-3.3p.exe	Get hash	malicious	Browse	192.159.65.198
	http://rufus.akeo.ie/downloads/rufus-3.3.exe	Get hash	malicious	Browse	192.159.65.198
	rufus-3.5.exe	Get hash	malicious	Browse	185.199.108.153
	rufus-usb-3-3.exe	Get hash	malicious	Browse	185.199.111.153
	rufus-3.5.exe	Get hash	malicious	Browse	185.199.109.153
	rufus-3.5.exe	Get hash	malicious	Browse	185.199.108.153
github.com	Payment Advice Note from 05202021.jar	Get hash	malicious	Browse	140.82.121.4
	Payment Advice Note from 05202021.jar	Get hash	malicious	Browse	140.82.121.4
	Secured fILE.js	Get hash	malicious	Browse	140.82.121.3
	INVOICE NO 070FT06.exe	Get hash	malicious	Browse	140.82.121.3
	VertiPaq Analyzer 2.02.xlsm	Get hash	malicious	Browse	140.82.121.5
	VertiPaq Analyzer 2.02.xlsm	Get hash	malicious	Browse	140.82.121.6
	Quoataion.jar	Get hash	malicious	Browse	140.82.121.3
	Remittance-E-MAIL-Layout-11_.jar	Get hash	malicious	Browse	140.82.121.3
	Remittance-E-MAIL-Layout-11_.jar	Get hash	malicious	Browse	140.82.121.3
	Quotation.jar	Get hash	malicious	Browse	140.82.121.4
	Quotation.jar	Get hash	malicious	Browse	140.82.121.3
	Signed Contract.jar	Get hash	malicious	Browse	140.82.121.3
	IMG_0124.jar	Get hash	malicious	Browse	140.82.121.3
	Signed Contract.jar	Get hash	malicious	Browse	140.82.121.3
	IMG_0124.jar	Get hash	malicious	Browse	140.82.121.3
	XPBPS2DL.exe	Get hash	malicious	Browse	140.82.121.3
	Quotation.jar	Get hash	malicious	Browse	140.82.121.4
	Quotation.jar	Get hash	malicious	Browse	140.82.121.4
	ATTACHED DRAWING AND SPECIFICATION.jar	Get hash	malicious	Browse	140.82.121.4

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FASTLYUS	f9be348e_by_Libranalysis.exe	Get hash	malicious	Browse	185.199.108.154
	2078a047_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	Payment Advice Note from 05202021.jar	Get hash	malicious	Browse	185.199.108.154
	Payment Advice Note from 05202021.jar	Get hash	malicious	Browse	185.199.108.154
	f8d8164d_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	f8d8164d_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	0085b9f4536d96dafb67cb2293662f607266ae5da53d3.dll	Get hash	malicious	Browse	151.101.1.44
	be584e9b_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	442a6930_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	442a6930_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	#Ud83d#Udcde(801) 451.htm	Get hash	malicious	Browse	151.101.65.195
	4ce7ca7a_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	4ce7ca7a_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	Secured fILE.js	Get hash	malicious	Browse	185.199.108.154
	tUCoHhXo.dll	Get hash	malicious	Browse	151.101.1.44
	tUCoHhXo.dll	Get hash	malicious	Browse	151.101.1.44
	0e12ea4a_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	0e12ea4a_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	c78db2c6_by_Libranalysis.dll	Get hash	malicious	Browse	151.101.1.44
	44329,6550195602.dll	Get hash	malicious	Browse	151.101.1.44
GITHUBUS	f9be348e_by_Libranalysis.exe	Get hash	malicious	Browse	140.82.121.4
	Payment Advice Note from 05202021.jar	Get hash	malicious	Browse	140.82.121.4
	Payment Advice Note from 05202021.jar	Get hash	malicious	Browse	140.82.121.4
	Secured fILE.js	Get hash	malicious	Browse	140.82.121.3
	INVOICE NO 070FT06.exe	Get hash	malicious	Browse	140.82.121.3
	VertiPaq Analyzer 2.02.xlsm	Get hash	malicious	Browse	140.82.121.5
	VertiPaq Analyzer 2.02.xlsm	Get hash	malicious	Browse	140.82.121.6
	Quoataion.jar	Get hash	malicious	Browse	140.82.121.3
	Remittance-E-MAIL-Layout-11_.jar	Get hash	malicious	Browse	140.82.121.3
	Remittance-E-MAIL-Layout-11_.jar	Get hash	malicious	Browse	140.82.121.3
	Quotation.jar	Get hash	malicious	Browse	140.82.121.4
	Quotation.jar	Get hash	malicious	Browse	140.82.121.3
	Signed Contract.jar	Get hash	malicious	Browse	140.82.121.3
	IMG_0124.jar	Get hash	malicious	Browse	140.82.121.3
	Signed Contract.jar	Get hash	malicious	Browse	140.82.121.3
	IMG_0124.jar	Get hash	malicious	Browse	140.82.121.3
	XPBPS2DL.exe	Get hash	malicious	Browse	140.82.121.4
	Quotation.jar	Get hash	malicious	Browse	140.82.121.4
	Quotation.jar	Get hash	malicious	Browse	140.82.121.4
	ATTACHED DRAWING AND SPECIFICATION.jar	Get hash	malicious	Browse	140.82.121.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	rufus-3.13.exe	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	rufus-3.13.exe	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	rufus-3.13.exe	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	rufus-3.11.exe	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	filecoach[1].exe	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	Invoice_no.-9fwd7-xy0c5zge.pdf	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	Invoice_no.-9fwd7-xy0c5zge.pdf	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	Incoming_Fax-Kknsy vkomlus2.pdf	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	New Fax 8elrb bq7txtl4.pdf	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153
	https://val.filesconverterpro.com/js/FilesConverterProApp.exe	Get hash	malicious	Browse	140.82.121.3 185.199.109.154 185.199.110.153

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\Desktop\rufus.com	rufus-3.13.exe	Get hash	malicious	Browse
	rufus_3-4_fr_430321.exe	Get hash	malicious	Browse
	rufus-3.13.exe	Get hash	malicious	Browse
	rufus_3-4_fr_430321.exe	Get hash	malicious	Browse
	rufus-3.13.exe	Get hash	malicious	Browse
	rufus-2.9.exe	Get hash	malicious	Browse
	rufus-3.11.exe	Get hash	malicious	Browse
	rufus-3.4p.exe	Get hash	malicious	Browse
	rufus-portable-v3.10.exe	Get hash	malicious	Browse
	rufus-portable-v3.9.exe	Get hash	malicious	Browse
	rufus-3.9.exe	Get hash	malicious	Browse
	rufus-3.9.exe	Get hash	malicious	Browse
	https://github.com/pbatard/rufus/releases/download/v3.9/rufus-3.9.exe	Get hash	malicious	Browse
	rufus-3.9.exe	Get hash	malicious	Browse
	rufus-3.5.exe	Get hash	malicious	Browse
	rufus-usb-3-3.exe	Get hash	malicious	Browse
	rufus-3.5.exe	Get hash	malicious	Browse
	rufus-3.5.exe	Get hash	malicious	Browse
	Rufus 2.10.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Fido[1].ver Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.553719870222819
Encrypted:	false
SSDEEP:	3:zNeFEdlHgHMkCmE3K75Lv0FEdlHgHMkCmNKw8pn:U2sssE3K75LM2sssA
MD5:	21B6181F364A6F67D6F0B2749775D760
SHA1:	47ECAD418DC2AFC7AC43FCD2C20DDF2837496ABF
SHA-256:	8D475BE0934C0C7AAA00A441FC9FB6A5040D56AD5F21EC685CF483654D0151AF
SHA-512:	009F965D8D336A0B008DDB9B85AF663D760741638199EEABB12AF76AF443A2D7A0A16BC46E1B72033E5DE9B94131B76646A5B874F0E62CAB1F041EE7735DB14C
Malicious:	false
Reputation:	low
Preview:	z1 = https://github.com/pbatard/Fido/releases/download/v1.18/Fido.ps1.lzma.v1 = https://github.com/pbatard/Fido/releases/download/v1.11/Fido.ps1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Rufus_win.ver[1].sig Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	7.163857935602921
Encrypted:	false
SSDEEP:	6:t0nc7zQIYmRwL+ARhBSSRdtq4jad4NAMpdC9TuxmLmR3EST:t0nwQWRZARnBTja8AMW9qxOmRFT
MD5:	585BD296C1B00D93481BC60597F45574
SHA1:	6FC387F8E6B2AE98C13A92F8D17A448DD03666A5
SHA-256:	1788F672181B8D45EED3BE00F39CDE88F2633B60B986DA21E4E5A4D4DE2CF6F8
SHA-512:	08F4242DCB4E5D9BCED0B280FF49F2C91A240DD7507BE29F8687E81280C2E9AD0514D0F2DCF1D03574100F71EFEC4D3D2B7532FB39915ED02244DED31B8664D2
Malicious:	false
Reputation:	low
Preview:	Y......[..Q.U)x.......W..4...:.]lA2.j..k.C/.ns...m.k.tq..E....yQ.......?..^...?.>....W...{hk.).a<b.TTX{.v! ..m...b"c...Md4..].hCZ73...H.....34.............q._?..h.DC.............K.....L}........1.....#....u..t.u.~Q..i.A.z&y0._.......N...x.:@.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Rufus_win[1].ver Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	5.187790638188705
Encrypted:	false
SSDEEP:	24:EzP/wnc3CBn6nTUvaUp1mdcD77HIv9pU1vTyLW3ZqCIfNBno:1UCBnQIvaUfm+/E9aTyLMMCKBno
MD5:	842CD37EA696B0772076094C3A51FBDE
SHA1:	2F7034AC577BD6FE0A49247393A6296E99C500D2
SHA-256:	C94054DE1DEE681D0D9124B0ADCC0FDAC8182CF609D1613CAD5A68F6A1EDAC8E
SHA-512:	41F6CBD6E3354BF017565D0EC875ECD46C2C12FFB28AB00F4D6543765651D11767FF91BBBE2596B2077EC0CF71EAB9E8B789A9D434ABC09A6C5C770736B1E90F
Malicious:	false
Reputation:	low
Preview:	version = 3.14.1788.platform_min = 6.1.download_url = https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14.exe.download_url_arm = https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm.exe.download_url_arm64 = https://github.com/pbatard/rufus/releases/download/v3.14/rufus-3.14_arm64.exe.release_notes = {\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1024{\fonttbl{\f0\fnil\fcharset0 Courier New;}{\f1\fnil\fcharset0 Arial Unicode MS;}{\f2\fnil\fcharset2 Symbol;}}..\pard\ltrpar\sl276\slmult1\b\f0\fs22\lang9\tab Rufus 3.14 (2021.04.30)\b0\par\par..\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent0{\pntxtb\'B7}}\ltrpar\fi-360\li720\sl276\slmult1\fs16 Improve DD write speed (uncompressed images only)\par.{\pntext\f2\'B7\tab}Improve checksum computation speed\par.{\pntext\f2\'B7\tab}Improve network connectivity detection\par.{\pntext\f2\'B7\tab}Only prompt for additional GRUB/Syslinux downloads when not writing in DD mode\par.{\pntext\f2\'B7\tab}Fix potential

C:\Users\user\AppData\Local\Temp\Ruf5D27.tmp Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1050378
Entropy (8bit):	6.380412282872303
Encrypted:	false
SSDEEP:	12288:2leTptPtqLcM6Cb//I2AxptVv0SdPgYRFKzcoeFKFFs3ZDlu/IApsDsiHgzhLcS2:20XM6CsT90SRGzBeFKFFs3ZDlu0anqB
MD5:	A5E75F38E202625661BAF5582912583F
SHA1:	55D149D862D5A3542883E3706C0A9EE8434DC238
SHA-256:	7A4FB90CE7332206F7F7E93055085BB55D5F27E42CE8DD84C5EC3873A0CB375D
SHA-512:	8CF6BEC72B32881F105AD6F212B9C7E7392FD49BFEEB97A450E5D055DC75E4FF0B7EAEAD7E67A1A90A8741130B8E1E655E32A33B2AD7CD004F6A38E325F5B07A
Malicious:	false
Reputation:	low
Preview:	# . v3.14 "ko-KR" "Korean (...)"..l "en-US" "English (English)" 0x0409, 0x0809, 0x0c09, 0x1009, 0x1409, 0x1809, 0x1c09, 0x2009, 0x2409, 0x2809, 0x2c09, 0x3009, 0x3409, 0x3809, 0x3c09, 0x4009, 0x4409, 0x4809..v 3.14..t MSG_001 "Other instance detected"..t MSG_002 "Another Rufus application is running.\n"..."Please close the first application before running another one."..t MSG_003 "WARNING: ALL DATA ON DEVICE '%s' WILL BE DESTROYED.\n"..."To continue with this operation, click OK. To quit click CANCEL."..t MSG_004 "Rufus update policy"..t MSG_005 "Do you want to allow Rufus to check for application updates online?"..t MSG_006 "Close"..t MSG_007 "Cancel"..t MSG_008 "Yes"..t MSG_009 "No"..t MSG_010 "Bad blocks found"..t MSG_011 "Check completed: %d bad block(s) found\n"..." %d read error(s)\n %d write error(s)\n %d corruption error(s)"..t MSG_012 "%s\nA more detailed report can be found in:\n%s"..t MSG_013 "Disabled"..t MSG_014 "Daily"..t MSG_015 "Weekly"..t MSG_016 "Monthly"..

C:\Users\user\AppData\Local\Temp\Ruf62F4.tmp Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1050378
Entropy (8bit):	6.380412282872303
Encrypted:	false
SSDEEP:	12288:2leTptPtqLcM6Cb//I2AxptVv0SdPgYRFKzcoeFKFFs3ZDlu/IApsDsiHgzhLcS2:20XM6CsT90SRGzBeFKFFs3ZDlu0anqB
MD5:	A5E75F38E202625661BAF5582912583F
SHA1:	55D149D862D5A3542883E3706C0A9EE8434DC238
SHA-256:	7A4FB90CE7332206F7F7E93055085BB55D5F27E42CE8DD84C5EC3873A0CB375D
SHA-512:	8CF6BEC72B32881F105AD6F212B9C7E7392FD49BFEEB97A450E5D055DC75E4FF0B7EAEAD7E67A1A90A8741130B8E1E655E32A33B2AD7CD004F6A38E325F5B07A
Malicious:	false
Reputation:	low
Preview:	# . v3.14 "ko-KR" "Korean (...)"..l "en-US" "English (English)" 0x0409, 0x0809, 0x0c09, 0x1009, 0x1409, 0x1809, 0x1c09, 0x2009, 0x2409, 0x2809, 0x2c09, 0x3009, 0x3409, 0x3809, 0x3c09, 0x4009, 0x4409, 0x4809..v 3.14..t MSG_001 "Other instance detected"..t MSG_002 "Another Rufus application is running.\n"..."Please close the first application before running another one."..t MSG_003 "WARNING: ALL DATA ON DEVICE '%s' WILL BE DESTROYED.\n"..."To continue with this operation, click OK. To quit click CANCEL."..t MSG_004 "Rufus update policy"..t MSG_005 "Do you want to allow Rufus to check for application updates online?"..t MSG_006 "Close"..t MSG_007 "Cancel"..t MSG_008 "Yes"..t MSG_009 "No"..t MSG_010 "Bad blocks found"..t MSG_011 "Check completed: %d bad block(s) found\n"..." %d read error(s)\n %d write error(s)\n %d corruption error(s)"..t MSG_012 "%s\nA more detailed report can be found in:\n%s"..t MSG_013 "Disabled"..t MSG_014 "Daily"..t MSG_015 "Weekly"..t MSG_016 "Monthly"..

C:\Users\user\Desktop\rufus.com Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	2.0422279901230667
Encrypted:	false
SSDEEP:	12:eFGSG1JCKJy2BstteOlJmU7SGZr4VzBpAOLBv:eFGSsi2aeOlIU7SGR4lBpAWBv
MD5:	D7E5D3A09EBFA04C5E2EB9BF6EC9947B
SHA1:	3D9EBBDDA068D39033AAE44001EFD8909919458C
SHA-256:	5F819F6EAE4B5845C082EDF14CB389AB9805BC3C17440F3B5398D4FDD0079FFE
SHA-512:	3D9B13233F1E1A08BEA071524B0B8430240224654A049284E97BB0BCA80C7BC0DAB92EA47D846000E9377CE0D599D64AD600749DF4BB59C925BE177F53FCF3A7
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 2%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rufus-3.13.exe, Detection: malicious, Browse Filename: rufus_3-4_fr_430321.exe, Detection: malicious, Browse Filename: rufus-3.13.exe, Detection: malicious, Browse Filename: rufus_3-4_fr_430321.exe, Detection: malicious, Browse Filename: rufus-3.13.exe, Detection: malicious, Browse Filename: rufus-2.9.exe, Detection: malicious, Browse Filename: rufus-3.11.exe, Detection: malicious, Browse Filename: rufus-3.4p.exe, Detection: malicious, Browse Filename: rufus-portable-v3.10.exe, Detection: malicious, Browse Filename: rufus-portable-v3.9.exe, Detection: malicious, Browse Filename: rufus-3.9.exe, Detection: malicious, Browse Filename: rufus-3.9.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: rufus-3.9.exe, Detection: malicious, Browse Filename: rufus-3.5.exe, Detection: malicious, Browse Filename: rufus-usb-3-3.exe, Detection: malicious, Browse Filename: rufus-3.5.exe, Detection: malicious, Browse Filename: rufus-3.5.exe, Detection: malicious, Browse Filename: Rufus 2.10.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K.z.K.z.K.z...'.H.z.K.{.N.z.K.z.J.z.B..J.z.RichK.z.................PE..L.....S..................................... ....@..........................0............................................... ..(.................................................................................... ...............................text............................... ..`.rdata....... ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\rufus.ini Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.828427586061969
Encrypted:	false
SSDEEP:	6:56TUBnJm2BnJmpB0jlmdXABnJmpB0jlmdX2rjqZ:DFTjqSTjq6jqZ
MD5:	3BDE2B347EA1765FC09C41A3863163FF
SHA1:	9CDA1B3BE44B1B8CEB8387037F4FF7FB7D1A9B88
SHA-256:	C0B147BC11F04B1034FF6DA7AEC1132EDDF156E63241D909EEB606A41CFBBBBF
SHA-512:	C40710A85C8B35189CE8337853F563E53909FA1AC8AD69594D0EA8DA3FDA982B08E4ACEDFBD41DB5DC416E84032E1745E59FC055B76F55EF883F1226666D416A
Malicious:	false
Reputation:	low
Preview:	Locale = en-US..Locale = en-US..CommCheck64 = 5794515..Locale = en-US..CommCheck64 = 5794515..UpdateCheckInterval = 86400..Locale = en-US..CommCheck64 = 5794515..UpdateCheckInterval = 86400..LastUpdateCheck = 13266106753..

C:\Users\user\Desktop\rufus.ini~ Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.828427586061969
Encrypted:	false
SSDEEP:	6:56TUBnJm2BnJmpB0jlmdXABnJmpB0jlmdX2rjqZ:DFTjqSTjq6jqZ
MD5:	3BDE2B347EA1765FC09C41A3863163FF
SHA1:	9CDA1B3BE44B1B8CEB8387037F4FF7FB7D1A9B88
SHA-256:	C0B147BC11F04B1034FF6DA7AEC1132EDDF156E63241D909EEB606A41CFBBBBF
SHA-512:	C40710A85C8B35189CE8337853F563E53909FA1AC8AD69594D0EA8DA3FDA982B08E4ACEDFBD41DB5DC416E84032E1745E59FC055B76F55EF883F1226666D416A
Malicious:	false
Reputation:	low
Preview:	Locale = en-US..Locale = en-US..CommCheck64 = 5794515..Locale = en-US..CommCheck64 = 5794515..UpdateCheckInterval = 86400..Locale = en-US..CommCheck64 = 5794515..UpdateCheckInterval = 86400..LastUpdateCheck = 13266106753..

C:\Windows\SysWOW64\GroupPolicy\gpt.ini Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.9228287372391675
Encrypted:	false
SSDEEP:	3:1EvdG3y:1AH
MD5:	39DFFC602ED934569F26BE44EC645814
SHA1:	40D9C2E74B8999AB8404D746E9DD219A58979813
SHA-256:	B57A88E5B1ACF3A784BE88B87FA3EE1F0991CB7C1C66DA423F3595FFC6E0C5C2
SHA-512:	02FB06F972BD37578B7788A8E8F26FE06C629FFB33A7590ACBD43F180CE2C3C4BA4D05E9047EB0978A3617E77A2EFC97CDBCDCBBFF81172B9D9F6BBED780B1AD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[General]..AccessCheck=test..

C:\Windows\System32\GroupPolicy\GPT.INI Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.090003435843543
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnkBfERvI3eovzFLsUov:1WsMzYHxbnKv3eoIv
MD5:	F9A49A3E2415016FA85DDFF0B8B38419
SHA1:	F8C987119269E58D22A6B17AE2E8ECA7744FB385
SHA-256:	14694DBEE3897B6BD5AA596EBFD893E727179B67811920C174DC70E6EEE8E579
SHA-512:	91EA129A51D2C3B342287C1250F5B0DA6BA2A61EFF11791D1CFAE1F5C6DD2654C935BE1452F4A681E794FD723A3C295E9BC9E59B9005AA4D8BD55ED36C9AD91C
Malicious:	true
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{3D271CFC-2BC6-4AC2-B633-3BDFF5BDAB2A}]..Version=1..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol Download File
Process:	C:\Users\user\Desktop\rufus-3.14p.exe
File Type:	data
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.2791226694111044
Encrypted:	false
SSDEEP:	3:CFlE3A5loWcNylRjlyWdl+Sli5lm+1XMRpvLZOal7EQlXYlWj0zG+EX8e7lll6zf:CFlEEoWcHWn+SkirHNblPl4Wj0S+fehW
MD5:	3679852D86D944EB0A0C1A29DC85E623
SHA1:	C8D898775714206A49355D1D7538E42F7235E2D9
SHA-256:	0372CB9877228AC59386A962D2E49B51F671E546A7BA112D43D6B2B15165AA7F
SHA-512:	6DA335F7F330DD75FED52BAB9A67442BF37AF876026B4C218F00F0264F068CBC865144546F3CFDFCE675DFDB3F2DABEBF55F6468A958AAF12E0396F22004EBD2
Malicious:	false
Preview:	PReg....[.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.P.o.l.i.c.i.e.s.\.E.x.p.l.o.r.e.r...;.N.o.D.r.i.v.e.T.y.p.e.A.u.t.o.r.u.n...;.....;.....;.....].

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	7.961230171156753
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rufus-3.14p.exe
File size:	1173560
MD5:	c1df434cf15aeb31783e1144b8a30059
SHA1:	1c385ec41d5f20ab411bd20e792ad8e7da7feaf9
SHA256:	c0ccf4f480545b50169cc1f5bf92b357ce588520cb8534128200ca48fc6ae588
SHA512:	7dcdd37b831c3e6d54ea5cb74e5308ead0ac3a344a94f40d70b1ad72746a830d0109ed3ddebd4fa6dc8a3cd8352545dd81164a1cff6fdbbcc9ed3312ecbe76f4
SSDEEP:	24576:g8wnf/FU0nBI1gbXfrnSuEw239Bwyu+4WVIBjP0q/E8kw2hd27:g5NlBI1gbmHw+BLu+5Il8qpb2hU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................$.0.......0#..V4..@#..p4...@.......................... 5.....39....@... ............................

File Icon


Icon Hash:	c8a2f0f074bc5e06

Static PE Info

General
Entrypoint:	0x7456c0
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x7462a2
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7326001be3ced77b153640be93a8dff6

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	3/16/2018 1:00:00 AM 3/17/2022 12:59:59 AM
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, STREET=24 Grey Rock, L=Milford, S=Co. Donegal, PostalCode=F92 D667, C=IE
Version:	3
Thumbprint MD5:	F9C8FB79581036F731B006B6D27C675B
Thumbprint SHA-1:	9CE9A71CCAB3B38A74781B975F1C228222CF7D3B
Thumbprint SHA-256:	CBD2B4DD0DB817BDEBF29B54503423F71F4603D2D7309E757DC17C4660E37451
Serial:	24692663EF6C0C0A3B23CFA310C3649B

Entrypoint Preview

Instruction
pushad
mov esi, 00634015h
lea edi, dword ptr [esi-00233015h]
push edi
mov ebp, esp
lea ebx, dword ptr [esp-00003E80h]
xor eax, eax
push eax
cmp esp, ebx
jne 00007F15D87804BDh
inc esi
inc esi
push ebx
push 00343C87h
push edi
add ebx, 04h
push ebx
push 001116A1h
push esi
add ebx, 04h
push ebx
push eax
mov dword ptr [ebx], 00020003h
push ebp
push edi
push esi
push ebx
sub esp, 7Ch
mov edx, dword ptr [esp+00000090h]
mov dword ptr [esp+74h], 00000000h
mov byte ptr [esp+73h], 00000000h
mov ebp, dword ptr [esp+0000009Ch]
lea eax, dword ptr [edx+04h]
mov dword ptr [esp+78h], eax
mov eax, 00000001h
movzx ecx, byte ptr [edx+02h]
mov ebx, eax
shl ebx, cl
mov ecx, ebx
dec ecx
mov dword ptr [esp+6Ch], ecx
movzx ecx, byte ptr [edx+01h]
shl eax, cl
dec eax
mov dword ptr [esp+68h], eax
mov eax, dword ptr [esp+000000A8h]
movzx esi, byte ptr [edx]
mov dword ptr [ebp+00h], 00000000h
mov dword ptr [esp+60h], 00000000h
mov dword ptr [eax], 00000000h
mov eax, 00000300h
mov dword ptr [esp+64h], esi
mov dword ptr [esp+5Ch], 00000001h
mov dword ptr [esp+58h], 00000001h
mov dword ptr [esp+54h], 00000001h
mov dword ptr [esp+50h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x351190	0x304	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x347000	0xa190	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11cc00	0x1c38	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x351494	0x20	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3462c4	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x233000	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0x234000	0x113000	0x112400	False	0.99911067827	data	7.99973764367	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x347000	0xb000	0xa600	False	0.295439570783	data	3.96284445539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x347e84	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294961151
RT_ICON	0x34c0b0	0x25a8	data
RT_ICON	0x34e65c	0x10a8	data
RT_ICON	0x34f708	0x988	data
RT_ICON	0x350094	0x468	GLS_BINARY_LSB_FIRST
RT_DIALOG	0x1274e8	0x95e	empty
RT_DIALOG	0x127e48	0x13c	empty
RT_DIALOG	0x127f88	0x1d6	empty
RT_DIALOG	0x128160	0x4f4	empty
RT_DIALOG	0x128658	0xac	empty
RT_DIALOG	0x128708	0xea	empty
RT_DIALOG	0x1287f8	0x252	empty
RT_DIALOG	0x128a50	0x330	empty
RT_DIALOG	0x128d80	0x1b0	empty
RT_DIALOG	0x128f30	0x3e2	empty
RT_RCDATA	0x129318	0x26a	empty
RT_RCDATA	0x129588	0x1a5	empty
RT_RCDATA	0x129730	0xcf	empty
RT_RCDATA	0x129800	0x73	empty
RT_RCDATA	0x129878	0xbf	empty
RT_RCDATA	0x129938	0x1f6	empty
RT_RCDATA	0x129b30	0x33b	empty
RT_RCDATA	0x129e70	0x1f0	empty
RT_RCDATA	0x12a060	0x181	empty
RT_RCDATA	0x12a1e8	0xda	empty
RT_RCDATA	0x12a2c8	0x154	empty
RT_RCDATA	0x12a420	0x279	empty
RT_RCDATA	0x12a6a0	0x430	empty
RT_RCDATA	0x12aad0	0x2dc	empty
RT_RCDATA	0x12adb0	0x120	empty
RT_RCDATA	0x12aed0	0x7d	empty
RT_RCDATA	0x12af50	0x10d	empty
RT_RCDATA	0x12b060	0x366	empty
RT_RCDATA	0x12b3c8	0x10581	empty
RT_RCDATA	0x13b950	0xb65d	empty
RT_RCDATA	0x146fb0	0xe43	empty
RT_RCDATA	0x147df8	0x2cb6	empty
RT_RCDATA	0x14aab0	0x3f74	empty
RT_RCDATA	0x14ea28	0x9da8	empty
RT_RCDATA	0x1587d0	0x7436	empty
RT_RCDATA	0x15fc08	0x7db2	empty
RT_RCDATA	0x1679c0	0x3331	empty
RT_RCDATA	0x16acf8	0x1940	empty
RT_RCDATA	0x16c638	0x1b93	empty
RT_RCDATA	0x16e1d0	0x155d	empty
RT_RCDATA	0x16f730	0x114f	empty
RT_RCDATA	0x170880	0x1c31	empty
RT_RCDATA	0x1724b8	0x1cf1	empty
RT_RCDATA	0x1741b0	0x150b	empty
RT_RCDATA	0x1756c0	0x1b3d	empty
RT_RCDATA	0x177200	0x1699	empty
RT_RCDATA	0x1788a0	0x15a7	empty
RT_RCDATA	0x179e48	0x1c3c	empty
RT_RCDATA	0x17ba88	0x1fb7	empty
RT_RCDATA	0x17da40	0x1889	empty
RT_RCDATA	0x17f2d0	0x1e4e	empty
RT_RCDATA	0x181120	0x193a	empty
RT_RCDATA	0x182a60	0x1e71	empty
RT_RCDATA	0x1848d8	0x22e1	empty
RT_RCDATA	0x186bc0	0x1426	empty
RT_RCDATA	0x187fe8	0x200	empty
RT_RCDATA	0x1881e8	0x8e88	empty
RT_RCDATA	0x191070	0x200	empty
RT_RCDATA	0x191270	0x10a19	empty
RT_RCDATA	0x1a1c90	0x855c	empty
RT_RCDATA	0x1aa1f0	0x2000	empty
RT_RCDATA	0x1ac1f0	0x7cfe	empty
RT_RCDATA	0x1b3ef0	0x4f1	empty
RT_RCDATA	0x1b43e8	0x10070a	empty
RT_RCDATA	0x2b4af8	0x800	data
RT_RCDATA	0x2b52f8	0x80000	data
RT_GROUP_ICON	0x350500	0x4c	data
RT_VERSION	0x350550	0x37c	data
RT_MANIFEST	0x3508d0	0x8be	XML 1.0 document, ASCII text, with CRLF line terminators

Imports

DLL	Import
ADVAPI32.dll	FreeSid
COMCTL32.DLL	ImageList_Create
COMDLG32.DLL	GetOpenFileNameW
CRYPT32.dll	CryptMsgClose
GDI32.dll	LineTo
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
msvcrt.dll	_iob
ole32.dll	CoCreateGuid
SETUPAPI.dll	CM_Get_Child
SHELL32.dll	ShellExecuteA
SHLWAPI.dll	wnsprintfW
USER32.dll	GetDC
WINTRUST.dll	WinVerifyTrustEx

Version Infos

Description	Data
LegalCopyright	2011-2021 Pete Batard (GPL v3)
InternalName	Rufus
FileVersion	3.14.1788
CompanyName	Akeo Consulting
LegalTrademarks	https://www.gnu.org/licenses/gpl-3.0.html
Comments	https://rufus.ie
ProductName	Rufus
ProductVersion	3.14.1788
FileDescription	Rufus
OriginalFilename	rufus-3.14.exe
Translation	0x0000 0x04b0

Network Behavior

Network Port Distribution

Total Packets: 92
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2021 23:38:57.020220995 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.064358950 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.064553976 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.093904972 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.137965918 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.139271975 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.139303923 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.139323950 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.139353991 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.139393091 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.280879021 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.325328112 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.325531006 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.544962883 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.547265053 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.589083910 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.589214087 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.591573954 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.592170954 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.592253923 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:38:57.679172993 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:38:57.717772007 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.759175062 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.759278059 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.760317087 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.801884890 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.801893950 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.801981926 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.824939966 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.868889093 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.868972063 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.871081114 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.871191025 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.912444115 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.912558079 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.912874937 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.913825989 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.913851023 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.913867950 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.913887024 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:57.913924932 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:57.913976908 CEST	49746	443	192.168.2.4	140.82.121.3
May 21, 2021 23:38:58.000866890 CEST	443	49746	140.82.121.3	192.168.2.4
May 21, 2021 23:38:58.020771027 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.064757109 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.064883947 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.065583944 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.109559059 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.110976934 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.111013889 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.111035109 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.111068964 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.111099958 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.125333071 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.170111895 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.170269012 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.171787024 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.171849012 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.215816021 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.216094971 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.216223955 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.216474056 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.217040062 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.217163086 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.217179060 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.217190027 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.217214108 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.217225075 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.217238903 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.217262030 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.217262030 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.217278004 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.217288017 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:38:58.217294931 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.217327118 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.217350960 CEST	49748	443	192.168.2.4	185.199.109.154
May 21, 2021 23:38:58.307919979 CEST	443	49748	185.199.109.154	192.168.2.4
May 21, 2021 23:39:13.350042105 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.394062042 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.395098925 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.395157099 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.395175934 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.395194054 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.395206928 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.395309925 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.395363092 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.395370960 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.397190094 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.456417084 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.456444979 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.456458092 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.456470966 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.456629038 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.456685066 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.458226919 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.458353996 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.458456993 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.458548069 CEST	49745	443	192.168.2.4	185.199.110.153
May 21, 2021 23:39:13.503892899 CEST	443	49745	185.199.110.153	192.168.2.4
May 21, 2021 23:39:13.505064011 CEST	443	49745	185.199.110.153	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2021 23:38:34.876351118 CEST	62389	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:34.952224016 CEST	53	62389	8.8.8.8	192.168.2.4
May 21, 2021 23:38:35.053282976 CEST	49910	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:35.107882977 CEST	53	49910	8.8.8.8	192.168.2.4
May 21, 2021 23:38:36.169996977 CEST	55854	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:36.222067118 CEST	53	55854	8.8.8.8	192.168.2.4
May 21, 2021 23:38:37.259495020 CEST	64549	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:37.309348106 CEST	53	64549	8.8.8.8	192.168.2.4
May 21, 2021 23:38:38.337084055 CEST	63153	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:38.395374060 CEST	53	63153	8.8.8.8	192.168.2.4
May 21, 2021 23:38:39.017751932 CEST	52991	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:39.077207088 CEST	53	52991	8.8.8.8	192.168.2.4
May 21, 2021 23:38:39.956604958 CEST	53700	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:40.006114006 CEST	53	53700	8.8.8.8	192.168.2.4
May 21, 2021 23:38:41.151401043 CEST	51726	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:41.202150106 CEST	53	51726	8.8.8.8	192.168.2.4
May 21, 2021 23:38:42.362709999 CEST	56794	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:42.415198088 CEST	53	56794	8.8.8.8	192.168.2.4
May 21, 2021 23:38:43.924002886 CEST	56534	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:43.977313042 CEST	53	56534	8.8.8.8	192.168.2.4
May 21, 2021 23:38:47.336246967 CEST	56627	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:47.385548115 CEST	53	56627	8.8.8.8	192.168.2.4
May 21, 2021 23:38:49.179631948 CEST	56621	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:49.229218006 CEST	53	56621	8.8.8.8	192.168.2.4
May 21, 2021 23:38:50.777450085 CEST	63116	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:50.826862097 CEST	53	63116	8.8.8.8	192.168.2.4
May 21, 2021 23:38:52.261770010 CEST	64078	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:52.319508076 CEST	53	64078	8.8.8.8	192.168.2.4
May 21, 2021 23:38:53.415143967 CEST	64801	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:53.473680019 CEST	53	64801	8.8.8.8	192.168.2.4
May 21, 2021 23:38:54.596632004 CEST	61721	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:54.650942087 CEST	53	61721	8.8.8.8	192.168.2.4
May 21, 2021 23:38:55.877749920 CEST	51255	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:55.928312063 CEST	53	51255	8.8.8.8	192.168.2.4
May 21, 2021 23:38:56.938255072 CEST	61522	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:57.000113010 CEST	53	61522	8.8.8.8	192.168.2.4
May 21, 2021 23:38:57.649425983 CEST	52337	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:57.713906050 CEST	53	52337	8.8.8.8	192.168.2.4
May 21, 2021 23:38:57.829183102 CEST	55046	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:57.883619070 CEST	53	55046	8.8.8.8	192.168.2.4
May 21, 2021 23:38:57.956829071 CEST	49612	53	192.168.2.4	8.8.8.8
May 21, 2021 23:38:58.017570019 CEST	53	49612	8.8.8.8	192.168.2.4
May 21, 2021 23:39:02.125274897 CEST	49285	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:02.187629938 CEST	53	49285	8.8.8.8	192.168.2.4
May 21, 2021 23:39:03.216007948 CEST	50601	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:03.265439987 CEST	53	50601	8.8.8.8	192.168.2.4
May 21, 2021 23:39:04.289550066 CEST	60875	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:04.342093945 CEST	53	60875	8.8.8.8	192.168.2.4
May 21, 2021 23:39:09.732098103 CEST	56448	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:09.801233053 CEST	53	56448	8.8.8.8	192.168.2.4
May 21, 2021 23:39:21.452508926 CEST	59172	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:21.521725893 CEST	53	59172	8.8.8.8	192.168.2.4
May 21, 2021 23:39:32.971236944 CEST	62420	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:33.033637047 CEST	53	62420	8.8.8.8	192.168.2.4
May 21, 2021 23:39:33.686220884 CEST	60579	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:33.746915102 CEST	53	60579	8.8.8.8	192.168.2.4
May 21, 2021 23:39:34.356216908 CEST	50183	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:34.405659914 CEST	53	50183	8.8.8.8	192.168.2.4
May 21, 2021 23:39:34.872829914 CEST	61531	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:34.931299925 CEST	53	61531	8.8.8.8	192.168.2.4
May 21, 2021 23:39:35.568346024 CEST	49228	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:35.573966026 CEST	59794	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:35.620893002 CEST	53	49228	8.8.8.8	192.168.2.4
May 21, 2021 23:39:35.646933079 CEST	53	59794	8.8.8.8	192.168.2.4
May 21, 2021 23:39:36.460649967 CEST	55916	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:36.521478891 CEST	53	55916	8.8.8.8	192.168.2.4
May 21, 2021 23:39:37.890412092 CEST	52752	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:37.940020084 CEST	53	52752	8.8.8.8	192.168.2.4
May 21, 2021 23:39:39.924572945 CEST	60542	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:39.984623909 CEST	53	60542	8.8.8.8	192.168.2.4
May 21, 2021 23:39:40.874274015 CEST	60689	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:40.923599958 CEST	53	60689	8.8.8.8	192.168.2.4
May 21, 2021 23:39:41.372014999 CEST	64206	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:41.421391010 CEST	53	64206	8.8.8.8	192.168.2.4
May 21, 2021 23:39:48.552067995 CEST	50904	53	192.168.2.4	8.8.8.8
May 21, 2021 23:39:48.611100912 CEST	53	50904	8.8.8.8	192.168.2.4
May 21, 2021 23:40:24.821425915 CEST	57525	53	192.168.2.4	8.8.8.8
May 21, 2021 23:40:24.882407904 CEST	53	57525	8.8.8.8	192.168.2.4
May 21, 2021 23:40:26.746659994 CEST	53814	53	192.168.2.4	8.8.8.8
May 21, 2021 23:40:26.822731972 CEST	53	53814	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 21, 2021 23:38:56.938255072 CEST	192.168.2.4	8.8.8.8	0xa933	Standard query (0)	rufus.ie	A (IP address)	IN (0x0001)
May 21, 2021 23:38:57.649425983 CEST	192.168.2.4	8.8.8.8	0x802a	Standard query (0)	github.com	A (IP address)	IN (0x0001)
May 21, 2021 23:38:57.956829071 CEST	192.168.2.4	8.8.8.8	0x2dc0	Standard query (0)	github-releases.githubusercontent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 21, 2021 23:38:57.000113010 CEST	8.8.8.8	192.168.2.4	0xa933	No error (0)	rufus.ie	185.199.110.153	A (IP address)	IN (0x0001)
May 21, 2021 23:38:57.000113010 CEST	8.8.8.8	192.168.2.4	0xa933	No error (0)	rufus.ie	185.199.111.153	A (IP address)	IN (0x0001)
May 21, 2021 23:38:57.000113010 CEST	8.8.8.8	192.168.2.4	0xa933	No error (0)	rufus.ie	185.199.108.153	A (IP address)	IN (0x0001)
May 21, 2021 23:38:57.000113010 CEST	8.8.8.8	192.168.2.4	0xa933	No error (0)	rufus.ie	185.199.109.153	A (IP address)	IN (0x0001)
May 21, 2021 23:38:57.713906050 CEST	8.8.8.8	192.168.2.4	0x802a	No error (0)	github.com	140.82.121.3	A (IP address)	IN (0x0001)
May 21, 2021 23:38:58.017570019 CEST	8.8.8.8	192.168.2.4	0x2dc0	No error (0)	github-releases.githubusercontent.com	185.199.109.154	A (IP address)	IN (0x0001)
May 21, 2021 23:38:58.017570019 CEST	8.8.8.8	192.168.2.4	0x2dc0	No error (0)	github-releases.githubusercontent.com	185.199.110.154	A (IP address)	IN (0x0001)
May 21, 2021 23:38:58.017570019 CEST	8.8.8.8	192.168.2.4	0x2dc0	No error (0)	github-releases.githubusercontent.com	185.199.111.154	A (IP address)	IN (0x0001)
May 21, 2021 23:38:58.017570019 CEST	8.8.8.8	192.168.2.4	0x2dc0	No error (0)	github-releases.githubusercontent.com	185.199.108.154	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
May 21, 2021 23:38:57.139303923 CEST	185.199.110.153	443	192.168.2.4	49745	CN=rufus.ie CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sat Apr 03 20:16:10 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Fri Jul 02 20:16:10 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0	6271f898ce5be7dd52b0fc260d0662b3
May 21, 2021 23:38:57.139303923 CEST	185.199.110.153	443	192.168.2.4	49745	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		6271f898ce5be7dd52b0fc260d0662b3
May 21, 2021 23:38:57.801893950 CEST	140.82.121.3	443	192.168.2.4	49746	CN=github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1, O="DigiCert, Inc.", C=US	CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1, O="DigiCert, Inc.", C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Mar 25 01:00:00 CET 2021 Thu Dec 17 01:00:00 CET 2020	Thu Mar 31 01:59:59 CEST 2022 Tue Dec 17 00:59:59 CET 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0	6271f898ce5be7dd52b0fc260d0662b3
May 21, 2021 23:38:57.801893950 CEST	140.82.121.3	443	192.168.2.4	49746	CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1, O="DigiCert, Inc.", C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Dec 17 01:00:00 CET 2020	Tue Dec 17 00:59:59 CET 2030		6271f898ce5be7dd52b0fc260d0662b3
May 21, 2021 23:38:58.111035109 CEST	185.199.109.154	443	192.168.2.4	49748	CN=www.github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 06 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Apr 14 14:00:00 CEST 2022 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0	6271f898ce5be7dd52b0fc260d0662b3
May 21, 2021 23:38:58.111035109 CEST	185.199.109.154	443	192.168.2.4	49748	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		6271f898ce5be7dd52b0fc260d0662b3

Code Manipulations

Statistics

Behavior

• rufus-3.14p.exe
• rufus-3.14p.exe

Click to jump to process

System Behavior

Analysis Process: rufus-3.14p.exe PID: 6836 Parent PID: 6044

General

Start time:	23:38:42
Start date:	21/05/2021
Path:	C:\Users\user\Desktop\rufus-3.14p.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\rufus-3.14p.exe'
Imagebase:	0xd10000
File size:	1173560 bytes
MD5 hash:	C1DF434CF15AEB31783E1144B8A30059
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

General

Start time:	23:38:43
Start date:	21/05/2021
Path:	C:\Users\user\Desktop\rufus-3.14p.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\rufus-3.14p.exe'
Imagebase:	0xd10000
File size:	1173560 bytes
MD5 hash:	C1DF434CF15AEB31783E1144B8A30059
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Disassembly

Code Analysis

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report rufus-3.14p.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Cryptography:

Compliance:

Spreading:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre