Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
C:\Windows\System32\GroupPolicy\gpt.ini
|
ASCII text, with CRLF line terminators
|
modified
|
 |
|
|
C:\Users\user\AppData\Local\Temp\RufA552.tmp
|
Unicode text, UTF-8 text, with very long lines (555), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\Downloads\Unconfirmed 379648.crdownload
|
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
|
dropped
|
||
|
C:\Users\user\Downloads\a334bdac-aeb5-4013-986b-f4215f2d5b31.tmp
|
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
|
dropped
|
||
|
C:\Users\user\Downloads\rufus-4.4.exe (copy)
|
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
|
dropped
|
||
|
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
|
RAGE Package Format (RPF),
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Downloads\rufus-4.4.exe
|
"C:\Users\user\Downloads\rufus-4.4.exe"
|
|
|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,4732492817931774946,1826627398002605485,131072
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
--lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://therufus.org/download.php"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1676,4732492817931774946,1826627398002605485,131072
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
--lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3444 /prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1676,4732492817931774946,1826627398002605485,131072
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
--lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2948 /prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1676,4732492817931774946,1826627398002605485,131072
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
--lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6864 /prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1676,4732492817931774946,1826627398002605485,131072
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
--lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6924 /prefetch:8
|
||
|
C:\Windows\System32\vdsldr.exe
|
C:\Windows\System32\vdsldr.exe -Embedding
|
||
|
C:\Windows\System32\vds.exe
|
C:\Windows\System32\vds.exe
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://therufus.org/download.php
|
|
||
|
https://tortoisesvn.net/
|
unknown
|
||
|
https://github.com/libtom/libtomcrypt
|
unknown
|
||
|
https://www.gnu.org/software/fdisk
|
unknown
|
||
|
https://www.gnu.org/software/grub
|
unknown
|
||
|
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
|
unknown
|
||
|
http://ocsp.sectigo.com0
|
unknown
|
||
|
https://systeminformer.sourceforge.io/
|
unknown
|
||
|
https://svn.reactos.org/reactos/trunk
|
unknown
|
||
|
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
|
unknown
|
||
|
https://github.com/cupofocha
|
unknown
|
||
|
https://www.busybox.net/
|
unknown
|
||
|
https://bit.ly/40qDtyF.
|
unknown
|
||
|
https://tortoisegit.org/
|
unknown
|
||
|
https://kolibrios.org/
|
unknown
|
||
|
https://winscp.net/
|
unknown
|
||
|
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
|
unknown
|
||
|
https://svn.reactos.org/reactos/trunk/reactos/dll/win32/fmifs
|
unknown
|
||
|
https://rufus.ie).
|
unknown
|
||
|
https://rufus.ie/Fido.verz1https://github.com/pbatard/FidoWARNING:
|
unknown
|
||
|
https://sourceforge.net/projects/smartmontools
|
unknown
|
||
|
https://www.gnu.org/licenses/gpl-3.0.htmlD
|
unknown
|
||
|
https://github.com/weidai11/cryptopp/
|
unknown
|
||
|
https://spclient.wg.spotify.com/v1/live-tile-xml?region=GB&language=en-US
|
35.186.224.25
|
||
|
http://e2fsprogs.sourceforge.net/
|
unknown
|
||
|
https://github.com/pbatard/rufus/issues
|
unknown
|
||
|
https://7-zip.org/openESPWarning:
|
unknown
|
||
|
https://www.gnupg.org/
|
unknown
|
||
|
https://gist.github.com/mattifestation/92e545bf1ee5b68eeb71d254cec2f78e
|
unknown
|
||
|
http://ms-sys.sourceforge.net/
|
unknown
|
||
|
https://rufus.ie/Fido.ver
|
unknown
|
||
|
https://github.com/SiderealArt
|
unknown
|
||
|
https://www.reactos.org/
|
unknown
|
||
|
http://www.ridgecrop.demon.co.uk/index.htm?fat32format.htm
|
unknown
|
||
|
https://rufus.ieopen321Failed
|
unknown
|
||
|
https://rufus.ieRufusRunning
|
unknown
|
||
|
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
|
unknown
|
||
|
https://rufus.ie/CheckForBetashttps://rufus.ieUsing
|
unknown
|
||
|
https://rufus.ie/
|
unknown
|
||
|
https://sectigo.com/CPS0
|
unknown
|
||
|
https://github.com/kokke/tiny-regex-c
|
unknown
|
||
|
https://rufus.ie
|
unknown
|
||
|
http://halamix2.pl
|
unknown
|
||
|
https://www.gnu.org/software/wget
|
unknown
|
||
|
https://therufus.org/download.php
|
104.21.65.18
|
||
|
https://github.com/pbatard/rufus/releases/download/v4.4/rufus-4.4.exe
|
140.82.113.3
|
||
|
https://github.com/pbatard/rufus/wiki/FAQ#bsods-with-windows-to-go-drives-created-from-windows-10-18
|
unknown
|
||
|
https://rufus.ie/files
|
unknown
|
||
|
https://goo.gl/QTobxX.;
|
unknown
|
||
|
https://axialis.com/
|
unknown
|
||
|
https://www.freedos.org/
|
unknown
|
||
|
https://github.com/pbatard/bled
|
unknown
|
||
|
https://github.com/pbatard/rufus/blob/master/res/loc/ChangeLog.txt
|
unknown
|
||
|
https://syslinux.org/
|
unknown
|
||
|
https://rufus.ie/files%s/%s-%s/%sGrub2%s
|
unknown
|
||
|
https://www.codeguru.com/forum/showthread.php?p=1951973
|
unknown
|
||
|
http://ocsp.sectigo.com0$
|
unknown
|
||
|
https://github.com/pbatard/uefi-ntfs.
|
unknown
|
||
|
https://github.com/u-boot/u-boot
|
unknown
|
||
|
https://github.com/pbatard/Fido
|
unknown
|
||
|
https://github.com/chenall/grub4dos
|
unknown
|
||
|
https://github.com/Chocobo1
|
unknown
|
||
|
https://un.akeo.ie
|
unknown
|
||
|
http://fsf.org/
|
unknown
|
||
|
http://freedos.sourceforge.net/freecom
|
unknown
|
||
|
https://7-zip.org/
|
unknown
|
||
|
https://goo.gl/QTobxX.
|
unknown
|
||
|
https://www.gnu.org/software/libcdio
|
unknown
|
There are 57 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
github.com
|
140.82.113.3
|
||
|
therufus.org
|
104.21.65.18
|
||
|
www.google.com
|
142.251.16.99
|
||
|
objects.githubusercontent.com
|
185.199.110.133
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
192.168.11.20
|
unknown
|
unknown
|
||
|
140.82.113.3
|
github.com
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
104.21.65.18
|
therufus.org
|
United States
|
||
|
142.251.16.99
|
www.google.com
|
United States
|
||
|
185.199.110.133
|
objects.githubusercontent.com
|
Netherlands
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{DE605FE2-09C4-4631-B97D-8938F5DCD9EB}Machine\Software\Policies\Microsoft\Windows
Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{DE605FE2-09C4-4631-B97D-8938F5DCD9EB}Machine\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
|
NoDriveTypeAutorun
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Akeo Consulting\Rufus
|
Locale
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Akeo Consulting\Rufus
|
CommCheck64
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Akeo Consulting\Rufus
|
UpdateCheckInterval
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
26DEBF33000
|
heap
|
page read and write
|
||
|
7FF6ED40A000
|
unkown
|
page execute and read and write
|
||
|
264E1548000
|
heap
|
page read and write
|
||
|
7FF6ED6B4000
|
unkown
|
page read and write
|
||
|
26DEBF2E000
|
heap
|
page read and write
|
||
|
CAE553C000
|
stack
|
page read and write
|
||
|
1A331485000
|
heap
|
page read and write
|
||
|
7FF6ED5DD000
|
unkown
|
page execute and read and write
|
||
|
26DEBE97000
|
heap
|
page read and write
|
||
|
7FF6ED5B4000
|
unkown
|
page execute and read and write
|
||
|
C8A0DFE000
|
stack
|
page read and write
|
||
|
C89FDF8000
|
stack
|
page read and write
|
||
|
26DEBE80000
|
heap
|
page read and write
|
||
|
7FF6ED3FE000
|
unkown
|
page execute and read and write
|
||
|
26DEC0C5000
|
heap
|
page read and write
|
||
|
264E1C70000
|
heap
|
page read and write
|
||
|
26DEBF3B000
|
heap
|
page read and write
|
||
|
8CC76FE000
|
stack
|
page read and write
|
||
|
26DEBF3B000
|
heap
|
page read and write
|
||
|
264E13F0000
|
heap
|
page read and write
|
||
|
26DF15C0000
|
trusted library section
|
page read and write
|
||
|
C8A0BFF000
|
stack
|
page read and write
|
||
|
26DEBF36000
|
heap
|
page read and write
|
||
|
8CC797F000
|
stack
|
page read and write
|
||
|
7FF6ED2E0000
|
unkown
|
page readonly
|
||
|
264E12B0000
|
heap
|
page read and write
|
||
|
26DEBF38000
|
heap
|
page read and write
|
||
|
26DEDBF1000
|
heap
|
page read and write
|
||
|
7FF6ED3F5000
|
unkown
|
page execute and read and write
|
||
|
26DEBEEE000
|
heap
|
page read and write
|
||
|
264E1512000
|
heap
|
page read and write
|
||
|
CAE5A7E000
|
stack
|
page read and write
|
||
|
CAE59FE000
|
stack
|
page read and write
|
||
|
264E1532000
|
heap
|
page read and write
|
||
|
1A331480000
|
heap
|
page read and write
|
||
|
26DEBF0D000
|
heap
|
page read and write
|
||
|
26DEBF36000
|
heap
|
page read and write
|
||
|
26DEDD30000
|
trusted library allocation
|
page read and write
|
||
|
26DEF340000
|
trusted library allocation
|
page read and write
|
||
|
26DEBFF0000
|
heap
|
page read and write
|
||
|
1A331300000
|
heap
|
page read and write
|
||
|
CAE55BE000
|
stack
|
page read and write
|
||
|
26DEC0C0000
|
heap
|
page read and write
|
||
|
CAE597D000
|
stack
|
page read and write
|
||
|
7FF6ED3FA000
|
unkown
|
page execute and read and write
|
||
|
C8A03FE000
|
stack
|
page read and write
|
||
|
26DEBCE0000
|
heap
|
page read and write
|
||
|
26DEDD30000
|
trusted library allocation
|
page read and write
|
||
|
26DEBF36000
|
heap
|
page read and write
|
||
|
26DEDBF4000
|
heap
|
page read and write
|
||
|
26DEBF15000
|
heap
|
page read and write
|
||
|
8CC777E000
|
stack
|
page read and write
|
||
|
264E1C75000
|
heap
|
page read and write
|
||
|
26DEBEEE000
|
heap
|
page read and write
|
||
|
7FF6ED6B4000
|
unkown
|
page write copy
|
||
|
264E14F8000
|
heap
|
page read and write
|
||
|
1A331333000
|
heap
|
page read and write
|
||
|
26DEDE20000
|
heap
|
page read and write
|
||
|
1A331309000
|
heap
|
page read and write
|
||
|
8CC767C000
|
stack
|
page read and write
|
||
|
7FF6ED3DF000
|
unkown
|
page execute and read and write
|
||
|
C8A07FE000
|
stack
|
page read and write
|
||
|
7FF6ED563000
|
unkown
|
page execute and write copy
|
||
|
7FF6ED2E0000
|
unkown
|
page readonly
|
||
|
26DEBF38000
|
heap
|
page read and write
|
||
|
1A3310E0000
|
heap
|
page read and write
|
||
|
C8A05FE000
|
stack
|
page read and write
|
||
|
264E1518000
|
heap
|
page read and write
|
||
|
264E14F0000
|
heap
|
page read and write
|
||
|
1A33132B000
|
heap
|
page read and write
|
||
|
CAE5BFE000
|
stack
|
page read and write
|
||
|
26DEBF2E000
|
heap
|
page read and write
|
||
|
7FF6ED2E1000
|
unkown
|
page execute and read and write
|
||
|
26DEBF38000
|
heap
|
page read and write
|
||
|
8CC77FE000
|
stack
|
page read and write
|
||
|
26DF15A0000
|
trusted library section
|
page read and write
|
||
|
26DEBF0E000
|
heap
|
page read and write
|
||
|
264E1B90000
|
heap
|
page read and write
|
||
|
26DEBF1B000
|
heap
|
page read and write
|
||
|
26DEDBDF000
|
heap
|
page read and write
|
||
|
C8A09FF000
|
stack
|
page read and write
|
||
|
26DEDD20000
|
heap
|
page read and write
|
||
|
264E1536000
|
heap
|
page read and write
|
||
|
7FF6ED3EA000
|
unkown
|
page execute and read and write
|
||
|
26DEDD30000
|
trusted library allocation
|
page read and write
|
||
|
26DEDD30000
|
trusted library allocation
|
page read and write
|
||
|
7FF6ED3F2000
|
unkown
|
page execute and read and write
|
||
|
26DEDD30000
|
trusted library allocation
|
page read and write
|
||
|
7FF6ED3E7000
|
unkown
|
page execute and read and write
|
||
|
CAE587E000
|
stack
|
page read and write
|
||
|
7FF6ED6B0000
|
unkown
|
page execute and read and write
|
||
|
C8A01FD000
|
stack
|
page read and write
|
||
|
26DEDD30000
|
trusted library allocation
|
page read and write
|
||
|
26DEDD24000
|
heap
|
page read and write
|
||
|
26DEBE89000
|
heap
|
page read and write
|
||
|
C89FFFE000
|
stack
|
page read and write
|
||
|
26DEBF80000
|
heap
|
page read and write
|
||
|
26DEDBD6000
|
heap
|
page read and write
|
||
|
CAE58FE000
|
stack
|
page read and write
|
||
|
26DF15B0000
|
trusted library section
|
page read and write
|
||
|
CAE5B7F000
|
stack
|
page read and write
|
||
|
8CC78FE000
|
stack
|
page read and write
|
||
|
CAE5AFB000
|
stack
|
page read and write
|
||
|
26DEFBD0000
|
heap
|
page read and write
|
||
|
264E1551000
|
heap
|
page read and write
|
||
|
264E1530000
|
heap
|
page read and write
|
||
|
7FF6ED5B2000
|
unkown
|
page execute and read and write
|
||
|
1A331220000
|
heap
|
page read and write
|
||
|
8CC79FA000
|
stack
|
page read and write
|
||
|
1A331400000
|
heap
|
page read and write
|
There are 100 hidden memdumps, click here to show them.