File name:

rufus-4.6.exe

Full analysis: https://app.any.run/tasks/988c09f4-c711-4653-a94f-10be65c2f1b7
Verdict: Malicious activity
Analysis date: December 18, 2024, 11:17:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 3 sections
MD5:

8FE64DA09AF371B02A31828415ECE8F3

SHA1:

5B5C90DCD425C814B555A4567405601AA977EE0B

SHA256:

8279696C1D78B14618500E9135886A3667B9DECC65946F3729002E4BFDBB20AB

SSDEEP:

49152:d9kgFtkp4NxfvJwLv6S06WcSyYw+TkkU1xyocsO3j3054/Aqv3JedxLM1tYsNJfO:jkckp4NovdZSarkU1xws+z0SHJevLbMm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • rufus-4.6.exe (PID: 6388)

  • SUSPICIOUS

    • Executes as Windows Service

      • vds.exe (PID: 6464)
      • vds.exe (PID: 3928)

    • Executable content was dropped or overwritten

      • NovaBot-1.0.0 Setup.exe (PID: 7828)
      • Update.exe (PID: 1888)

    • Process drops legitimate windows executable

      • Update.exe (PID: 1888)

    • Starts itself from another location

      • Update.exe (PID: 1888)

    • Reads the date of Windows installation

      • Update.exe (PID: 1888)

    • Application launched itself

      • NovaBot.exe (PID: 7464)
      • NovaBot.exe (PID: 7144)
      • NovaBot.exe (PID: 6420)

    • Reads security settings of Internet Explorer

      • Update.exe (PID: 1888)

    • Creates a software uninstall entry

      • Update.exe (PID: 1888)

    • Searches for installed software

      • Update.exe (PID: 1888)

  • INFO

    • Reads the computer name

      • rufus-4.6.exe (PID: 6388)
      • identity_helper.exe (PID: 5972)
      • Update.exe (PID: 1888)
      • squirrel.exe (PID: 4976)
      • NovaBot.exe (PID: 7144)
      • NovaBot.exe (PID: 7900)
      • NovaBot.exe (PID: 8764)
      • NovaBot.exe (PID: 6420)
      • NovaBot.exe (PID: 8088)
      • NovaBot.exe (PID: 5572)

    • Checks supported languages

      • identity_helper.exe (PID: 5972)
      • NovaBot-1.0.0 Setup.exe (PID: 7828)
      • Update.exe (PID: 1888)
      • rufus-4.6.exe (PID: 6388)
      • Update.exe (PID: 8308)
      • squirrel.exe (PID: 4976)
      • NovaBot.exe (PID: 7724)
      • NovaBot.exe (PID: 7144)
      • NovaBot.exe (PID: 7900)
      • NovaBot.exe (PID: 8440)
      • NovaBot.exe (PID: 7464)
      • NovaBot.exe (PID: 7324)
      • NovaBot.exe (PID: 8764)
      • NovaBot.exe (PID: 7388)
      • NovaBot.exe (PID: 8088)
      • NovaBot.exe (PID: 5432)
      • NovaBot.exe (PID: 5572)
      • NovaBot.exe (PID: 6540)
      • NovaBot.exe (PID: 6420)

    • Manual execution by a user

      • msedge.exe (PID: 7116)
      • NovaBot-1.0.0 Setup.exe (PID: 7828)
      • msedge.exe (PID: 6984)
      • WinRAR.exe (PID: 8920)
      • NovaBot.exe (PID: 6420)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 7116)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 8356)

    • Reads Environment values

      • identity_helper.exe (PID: 5972)

    • Process checks whether UAC notifications are on

      • rufus-4.6.exe (PID: 6388)

    • Sends debugging messages

      • rufus-4.6.exe (PID: 6388)

    • Reads the machine GUID from the registry

      • rufus-4.6.exe (PID: 6388)
      • Update.exe (PID: 1888)
      • Update.exe (PID: 8308)

    • Application launched itself

      • msedge.exe (PID: 7116)
      • msedge.exe (PID: 7220)

    • Creates files or folders in the user directory

      • squirrel.exe (PID: 4976)
      • Update.exe (PID: 1888)
      • NovaBot.exe (PID: 7144)
      • NovaBot.exe (PID: 7464)
      • NovaBot.exe (PID: 5572)
      • rufus-4.6.exe (PID: 6388)

    • Create files in a temporary directory

      • Update.exe (PID: 1888)

    • The sample compiled with english language support

      • Update.exe (PID: 1888)
      • msedge.exe (PID: 8288)

    • Process checks computer location settings

      • NovaBot.exe (PID: 7144)
      • Update.exe (PID: 1888)
      • NovaBot.exe (PID: 7464)
      • NovaBot.exe (PID: 6540)

    • Checks proxy server information

      • NovaBot.exe (PID: 7144)
      • NovaBot.exe (PID: 7464)
      • Update.exe (PID: 1888)
      • NovaBot.exe (PID: 6420)

    • Disables trace logs

      • Update.exe (PID: 1888)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 8288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:21 14:50:37+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.43
CodeSize: 1568768
InitializedDataSize: 45056
UninitializedDataSize: 3026944
EntryPoint: 0x462170
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 4.6.2208.0
ProductVersionNumber: 4.6.2208.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: https://rufus.ie
CompanyName: Akeo Consulting
FileDescription: Rufus
FileVersion: 4.6.2208
InternalName: Rufus
LegalCopyright: © 2011-2024 Pete Batard (GPL v3)
LegalTrademarks: https://www.gnu.org/licenses/gpl-3.0.html
OriginalFileName: rufus-4.6.exe
ProductName: Rufus
ProductVersion: 4.6.2208
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
271
Monitored processes
124
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start rufus-4.6.exe vdsldr.exe no specs vds.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs novabot-1.0.0 setup.exe update.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs squirrel.exe no specs novabot.exe no specs update.exe no specs novabot.exe no specs novabot.exe no specs novabot.exe no specs novabot.exe no specs novabot.exe no specs novabot.exe no specs novabot.exe no specs vds.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe novabot.exe no specs msedge.exe no specs novabot.exe no specs novabot.exe no specs novabot.exe no specs novabot.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rufus-4.6.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6692 --field-trial-handle=2364,i,9002774949511892514,18338804671930874010,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
536"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=8308 --field-trial-handle=2328,i,3990770093700990039,7645144301042553172,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
732"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2360 --field-trial-handle=2364,i,9002774949511892514,18338804671930874010,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
936"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4992 --field-trial-handle=2364,i,9002774949511892514,18338804671930874010,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1380"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=9032 --field-trial-handle=2328,i,3990770093700990039,7645144301042553172,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1468"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6848 --field-trial-handle=2364,i,9002774949511892514,18338804671930874010,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1572"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7060 --field-trial-handle=2364,i,9002774949511892514,18338804671930874010,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1596"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3448 --field-trial-handle=2364,i,9002774949511892514,18338804671930874010,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1744"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4420 --field-trial-handle=2364,i,9002774949511892514,18338804671930874010,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1888"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
NovaBot-1.0.0 Setup.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
2.0.1.1
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
19 092
Read events
18 787
Write events
168
Delete events
137

Modification events

(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\AppHVSI
Operation:writeName:AllowAppHVSI_ProviderSet
Value:
0
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\Network Connections
Operation:writeName:NC_DoNotShowLocalOnlyIcon
Value:
1
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\Windows Feeds
Operation:writeName:EnableFeeds
Value:
0
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUServer
Value:
http://neverupdatewindows10.com
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUStatusServer
Value:
http://neverupdatewindows10.com
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:UpdateServiceUrlAlternate
Value:
http://neverupdatewindows10.com
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:**del.FillEmptyContentUrls
Value:
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:UseWUServer
Value:
1
(PID) Process:(6388) rufus-4.6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C317F32D-51F8-4753-B0DD-DE265622B73E}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
0
Executable files
38
Suspicious files
1 070
Text files
231
Unknown types
7

Dropped files

PID
Process
Filename
Type
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF136c4a.TMP —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF136c59.TMP —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF136c69.TMP —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF136c69.TMP —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF136c59.TMP —
MD5:—
SHA256:—
7116msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
396
DNS requests
483
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
304
23.192.153.142:80
http://x1.i.lencr.org/
unknown
—
—
whitelisted
—
—
GET
304
23.192.153.142:80
http://r3.i.lencr.org/
unknown
—
—
whitelisted
5496
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5752
msedge.exe
GET
200
104.18.38.233:80
http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt
unknown
—
—
whitelisted
6164
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5752
msedge.exe
GET
200
104.18.38.233:80
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
unknown
—
—
whitelisted
8524
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.178:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5496
svchost.exe
20.49.150.241:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
GB
unknown
1544
RUXIMICS.exe
20.49.150.241:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
GB
unknown
4712
MoUsoCoreWorker.exe
20.49.150.241:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
GB
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
1176
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.178
  • 2.23.209.168
  • 2.23.209.171
  • 2.23.209.175
  • 2.23.209.179
  • 2.23.209.173
  • 2.23.209.174
  • 2.23.209.177
  • 2.23.209.181
  • 20.223.35.26
  • 104.126.37.171
  • 104.126.37.152
  • 104.126.37.145
  • 104.126.37.162
  • 104.126.37.161
  • 104.126.37.176
  • 104.126.37.170
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.136
  • 104.126.37.123
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.131
  • 104.126.37.179
  • 104.126.37.178
  • 104.126.37.186
  • 104.126.37.184
whitelisted
google.com
  • 142.250.181.238
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
  • 23.218.210.69
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.134
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted

Threats

PID
Process
Class
Message
5752
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
5752
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
5752
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
5752
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
5752
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5752
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
5752
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
5752
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5752
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5752
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
Process
Message
rufus-4.6.exe
*** Rufus init ***
rufus-4.6.exe
Cur dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.6.exe
App dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.6.exe
Usr dir: 'C:\Users\admin'
rufus-4.6.exe
Tmp dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.6.exe
Sys dir: 'C:\WINDOWS\system32'
rufus-4.6.exe
Dat dir: 'C:\Users\admin\AppData\Local'
rufus-4.6.exe
Binary executable is signed by 'Akeo Consulting'
rufus-4.6.exe
Will use settings from registry
rufus-4.6.exe
loc file not found in current directory - embedded one will be used
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rufus-4.6.exe