@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.

@nazokiyoubinbou @bms @briankrebs to my knowledge it doesn't even offer an installer. the only difference between the "standard" and "portable" versions is that the executable checks if it has the letter "p" in the filename. if it does not, then it stores its settings in the registry and if it does, then it uses a file called rufus.ini in the directory it was started from.

@snornik @snep @jordinki @briankrebs the "standard" version stores its settings in the registry