File name:

rufus-4.9p.exe

Full analysis: https://app.any.run/tasks/f64c7c95-4953-458a-b36e-cf0152202b8f
Verdict: Malicious activity
Analysis date: June 19, 2025, 04:10:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 3 sections
MD5:

E88A8AAA069B9B4C44A416FA7CD071F1

SHA1:

8769170FD144BF4EE45ECCDAF119E5818A34D68F

SHA256:

497F796E6D076D4855D697965C04626E6D3624658FCE3ECA82AB14F7414EEDE2

SSDEEP:

98304:WK+bYMEfEIOL2RsTihuHrqDSv3mzVHyg82nVYaWwob4WjH3BfHMW82IJhmx9oX0V:3j3Q9N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • rufus-4.9p.exe (PID: 5244)

  • SUSPICIOUS

    • Executes as Windows Service

      • vds.exe (PID: 5928)

    • Reads security settings of Internet Explorer

      • rufus-4.9p.exe (PID: 5244)

  • INFO

    • Create files in a temporary directory

      • rufus-4.9p.exe (PID: 5244)

    • Reads the computer name

      • rufus-4.9p.exe (PID: 5244)

    • Checks supported languages

      • rufus-4.9p.exe (PID: 5244)

    • Reads the machine GUID from the registry

      • rufus-4.9p.exe (PID: 5244)

    • Process checks whether UAC notifications are on

      • rufus-4.9p.exe (PID: 5244)

    • UPX packer has been detected

      • rufus-4.9p.exe (PID: 5244)

    • Checks proxy server information

      • rufus-4.9p.exe (PID: 5244)

    • Reads the software policy settings

      • rufus-4.9p.exe (PID: 5244)

    • Creates files or folders in the user directory

      • rufus-4.9p.exe (PID: 5244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 1997:02:13 09:52:27+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 2048000
InitializedDataSize: 45056
UninitializedDataSize: 4251648
EntryPoint: 0x602010
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.9.2256.0
ProductVersionNumber: 4.9.2256.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: https://rufus.ie
CompanyName: Akeo Consulting
FileDescription: Rufus
FileVersion: 4.9.2256
InternalName: Rufus
LegalCopyright: © 2011-2025 Pete Batard (GPL v3)
LegalTrademarks: https://www.gnu.org/licenses/gpl-3.0.html
OriginalFileName: rufus-4.9.exe
ProductName: Rufus
ProductVersion: 4.9.2256
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
5
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rufus-4.9p.exe vdsldr.exe no specs vds.exe no specs slui.exe no specs rufus-4.9p.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5244"C:\Users\admin\AppData\Local\Temp\rufus-4.9p.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.9p.exe
explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
HIGH
Description:
Rufus
Version:
4.9.2256
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.9p.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5928C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6188"C:\Users\admin\AppData\Local\Temp\rufus-4.9p.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.9p.exe—explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
MEDIUM
Description:
Rufus
Exit code:
3221226540
Version:
4.9.2256
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.9p.exe
c:\windows\system32\ntdll.dll
6840C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7020C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
8 424
Read events
7 991
Write events
383
Delete events
50

Modification events

(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\AppHVSI
Operation:writeName:AllowAppHVSI_ProviderSet
Value:
0
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\Network Connections
Operation:writeName:NC_DoNotShowLocalOnlyIcon
Value:
1
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\Windows Feeds
Operation:writeName:EnableFeeds
Value:
0
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUStatusServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:UpdateServiceUrlAlternate
Value:
http://neverupdatewindows10.com
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:**del.FillEmptyContentUrls
Value:
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:UseWUServer
Value:
1
(PID) Process:(5244) rufus-4.9p.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EB9E1C0E-89C8-4926-8AD3-E80A6E2B250D}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
0
Executable files
0
Suspicious files
8
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
5244rufus-4.9p.exeC:\Users\admin\AppData\Local\Temp\Ruf5DFE.tmptext
MD5:E4AAF25313710D508B4AF46118E4B7D3
SHA256:DB1D2C7C742887940C2E309164848118CFD56B45DC42DD173B25CE960F72E238
5244rufus-4.9p.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:45B1896F44FC43F9157B78602CBAFEA3
SHA256:C4E2130F76356ED894479097E11E2052DF2511A750242566768B98CD5FB45AC8
5244rufus-4.9p.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:9D8F7B558A7D800AFFAF3F0DF6B55987
SHA256:A5960D062B07F625A6F4916FBECE3ECCBD6910DF2970143B1DC36858A3E95810
5244rufus-4.9p.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:EDEF89D6437E961015F4205BA164AD93
SHA256:5C84E21131EA176820F43F40285C8820F4F67DFE8BFF145575FF80C25FFDD4D2
5244rufus-4.9p.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:1E9D0DD59655B96C8429BB2ECFF1B564
SHA256:FB665367839D3602E32D177D008553A155ECC7A0885298DDD69120FFA37C5BF9
5244rufus-4.9p.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Rufus_win[1].vertext
MD5:095E2CA935E870B15C200278A6F1B083
SHA256:9E536D8F6CD8B8D7C4051BD79D6343710E314894546ACAB24611E09E6C2E706E
5244rufus-4.9p.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8CFF94A6502E24DC82E1FBEB7044EEAbinary
MD5:4E6676A9E077B03B9E449003B8F9E7D3
SHA256:EF3304026C67595659E457481AE92BD30485724415EF898606128C6FC96FB8D5
5244rufus-4.9p.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:0C014C71A70DC7758BFDC822E974F1F3
SHA256:8EBD915268E16B55A3ABDE6F612363576FAB5DF656F955D672CCE8889C5FF9CA
5244rufus-4.9p.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:3D89F23265C9E30A0CF055C3EB4D637C
SHA256:806582F6221C79BD4C7EACDC4B63E937CE247EEE2BA159F55C545CDFB2B1C25B
5244rufus-4.9p.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8CFF94A6502E24DC82E1FBEB7044EEAbinary
MD5:81FB7B8759F5A49651E606CB1382750E
SHA256:6A286F9FA0ABFDC9348133DB9E229F96995F88ED5BE45EB85AEDAA13A0845A29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
30
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4168
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5244
rufus-4.9p.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
5244
rufus-4.9p.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
5244
rufus-4.9p.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CECoW9cIBGAf3CpJj3Tw5qfI%3D
unknown
—
—
whitelisted
2120
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2120
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5116
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2200
svchost.exe
224.0.0.251:5353
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2200
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4168
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4168
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.74.206
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.65
  • 20.190.160.132
  • 40.126.32.133
  • 20.190.160.14
  • 40.126.32.68
  • 20.190.160.5
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted

Threats

No threats detected
Process
Message
rufus-4.9p.exe
*** Rufus init ***
rufus-4.9p.exe
Sys dir: 'C:\WINDOWS\system32'
rufus-4.9p.exe
App dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.9p.exe
Cur dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.9p.exe
Dat dir: 'C:\Users\admin\AppData\Local'
rufus-4.9p.exe
Usr dir: 'C:\Users\admin'
rufus-4.9p.exe
Tmp dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.9p.exe
Binary executable is signed by 'Akeo Consulting'
rufus-4.9p.exe
Will use settings from INI file
rufus-4.9p.exe
localization: extracted data to 'C:\Users\admin\AppData\Local\Temp\Ruf5DFE.tmp'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rufus-4.9p.exe