File name:

rufus-4.9.exe

Full analysis: https://app.any.run/tasks/11afcab5-e852-4b96-a9c5-3d3c1303f35a
Verdict: Malicious activity
Analysis date: June 24, 2025, 06:46:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 3 sections
MD5:

E88A8AAA069B9B4C44A416FA7CD071F1

SHA1:

8769170FD144BF4EE45ECCDAF119E5818A34D68F

SHA256:

497F796E6D076D4855D697965C04626E6D3624658FCE3ECA82AB14F7414EEDE2

SSDEEP:

98304:WK+bYMEfEIOL2RsTihuHrqDSv3mzVHyg82nVYaWwob4WjH3BfHMW82IJhmx9oX0V:3j3Q9N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • rufus-4.9.exe (PID: 5340)

  • SUSPICIOUS

    • Executes as Windows Service

      • vds.exe (PID: 4040)

    • Reads security settings of Internet Explorer

      • rufus-4.9.exe (PID: 5340)

  • INFO

    • Reads the computer name

      • rufus-4.9.exe (PID: 5340)

    • Checks supported languages

      • rufus-4.9.exe (PID: 5340)

    • Reads the machine GUID from the registry

      • rufus-4.9.exe (PID: 5340)

    • Create files in a temporary directory

      • rufus-4.9.exe (PID: 5340)

    • Process checks whether UAC notifications are on

      • rufus-4.9.exe (PID: 5340)

    • Creates files or folders in the user directory

      • rufus-4.9.exe (PID: 5340)

    • UPX packer has been detected

      • rufus-4.9.exe (PID: 5340)

    • Checks proxy server information

      • rufus-4.9.exe (PID: 5340)

    • Reads the software policy settings

      • rufus-4.9.exe (PID: 5340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 1997:02:13 09:52:27+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 2048000
InitializedDataSize: 45056
UninitializedDataSize: 4251648
EntryPoint: 0x602010
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.9.2256.0
ProductVersionNumber: 4.9.2256.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: https://rufus.ie
CompanyName: Akeo Consulting
FileDescription: Rufus
FileVersion: 4.9.2256
InternalName: Rufus
LegalCopyright: © 2011-2025 Pete Batard (GPL v3)
LegalTrademarks: https://www.gnu.org/licenses/gpl-3.0.html
OriginalFileName: rufus-4.9.exe
ProductName: Rufus
ProductVersion: 4.9.2256
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
5
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rufus-4.9.exe vdsldr.exe no specs vds.exe no specs slui.exe no specs rufus-4.9.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4040C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4104C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5080"C:\Users\admin\AppData\Local\Temp\rufus-4.9.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.9.exe—explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
MEDIUM
Description:
Rufus
Exit code:
3221226540
Version:
4.9.2256
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.9.exe
c:\windows\system32\ntdll.dll
5340"C:\Users\admin\AppData\Local\Temp\rufus-4.9.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.9.exe
explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
HIGH
Description:
Rufus
Version:
4.9.2256
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.9.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7116C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
1 281
Read events
1 216
Write events
33
Delete events
32

Modification events

(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\AppHVSI
Operation:writeName:AllowAppHVSI_ProviderSet
Value:
0
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\Network Connections
Operation:writeName:NC_DoNotShowLocalOnlyIcon
Value:
1
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\Windows Feeds
Operation:writeName:EnableFeeds
Value:
0
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUStatusServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:UpdateServiceUrlAlternate
Value:
http://neverupdatewindows10.com
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:**del.FillEmptyContentUrls
Value:
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:UseWUServer
Value:
1
(PID) Process:(5340) rufus-4.9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{F10CEF5B-6801-4F42-942F-B8F92F033230}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
0
Executable files
3
Suspicious files
7
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
5340rufus-4.9.exeC:\Users\admin\AppData\Local\Temp\Ruf4F58.tmptext
MD5:E4AAF25313710D508B4AF46118E4B7D3
SHA256:DB1D2C7C742887940C2E309164848118CFD56B45DC42DD173B25CE960F72E238
5340rufus-4.9.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\commits[1].jsontext
MD5:7FCC9BB1BBBD63FFECD87193D0DC07E3
SHA256:E7C7B317E8AD88F4C8FC3C9CED1F9CFBCAB19B806A959AB7C6EB5CF53550219D
5340rufus-4.9.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Rufus_win.ver[1].sigbinary
MD5:D2ECFEF867E7D9A2D9AC2A918D695D45
SHA256:F9A325BB766B5240438931E6E164758AA21F1B6B1DA0C7EACD41081ECA45A502
5340rufus-4.9.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Rufus_win[1].vertext
MD5:095E2CA935E870B15C200278A6F1B083
SHA256:9E536D8F6CD8B8D7C4051BD79D6343710E314894546ACAB24611E09E6C2E706E
5340rufus-4.9.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:0C014C71A70DC7758BFDC822E974F1F3
SHA256:8EBD915268E16B55A3ABDE6F612363576FAB5DF656F955D672CCE8889C5FF9CA
5340rufus-4.9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:DD64B7D9757F2958966B683A2F5BDA25
SHA256:07359C4F2B5073826198B492BE966DED0BF23ADA575F63C83F61196EC047045D
5340rufus-4.9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:0A394632842C98774055F9FA9D42B7BC
SHA256:E18A9F2BCF9D72F3A4AFB4B5F6A01FE5615AFF2E4D24195533B6EB2A292DD3F5
5340rufus-4.9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:02A26D0FDFEBE2DEC7CAFCE3202A0869
SHA256:4E40A9B35E3D0D07DA74342969934ACCD0B120370DCEED07EB4C0516A8A668D5
5340rufus-4.9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8CFF94A6502E24DC82E1FBEB7044EEAbinary
MD5:8C2F0AFC9E109DE8101E60113B338A4F
SHA256:A21C042ED7F1974FE666BE7D2D379D88E19EC8C66504CD83C55B6D7A3BFA3D88
5340rufus-4.9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:3DDED3BA5F4F1CE9F7CD380A55F7A2F1
SHA256:99B2D922B98FA3F4019555A0B945974941932475932D0C99F8DAF878A5B0CF66
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2292
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5340
rufus-4.9.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
5340
rufus-4.9.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
5340
rufus-4.9.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CECoW9cIBGAf3CpJj3Tw5qfI%3D
unknown
—
—
whitelisted
3956
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3956
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6004
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2200
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2200
svchost.exe
224.0.0.251:5353
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.55.104.190
  • 23.55.104.172
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.65
  • 20.190.160.14
  • 20.190.160.66
  • 40.126.32.136
  • 20.190.160.17
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted

Threats

No threats detected
Process
Message
rufus-4.9.exe
Usr dir: 'C:\Users\admin'
rufus-4.9.exe
Tmp dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.9.exe
Sys dir: 'C:\WINDOWS\system32'
rufus-4.9.exe
Dat dir: 'C:\Users\admin\AppData\Local'
rufus-4.9.exe
Cur dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.9.exe
App dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.9.exe
*** Rufus init ***
rufus-4.9.exe
Will use settings from registry
rufus-4.9.exe
Binary executable is signed by 'Akeo Consulting'
rufus-4.9.exe
loc file not found in current directory - embedded one will be used
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rufus-4.9.exe