0c23d02d...ea44 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Dropper
Downloader
Spyware
Threat Names:
Emotet
Generic.EmotetU.C1B1709D
Gen:Variant.Razy.494038
...

sample.doc

Word Document

Created at 2020-01-21T19:55:00

...

Indicators

File (51)
»
Filename Hash Operations Category Severity
C:\Users\aETAdzjz\Desktop\sample.doc MD5: 2a14b3778299e0f147f8d6e93ad1fa4f
SHA1: 2b4ab607f4cc2ba39d223ad27203d7bac4a3c4c2
SHA256: 0c23d02d9bdfeff59ce2b2af56e357be4dcef9a08d157a380599d305dcb9ea44
SSDeep: 6144:90Rum7mdLRp1bbSBIR/EHGtCMXgTo8qoFt/etg+NXdxypi8wgHOHK20ujA6gNuzp:90E3dxtR/iU9mvUPrx98wgHOHK20ujA0
ImpHash: - 		Sample File
Malicious
11a8f947339d30605a086d0c8865366567767e0354baaf83a941c484b7cb297b MD5: db1a53e3909e68a32ccc3524ca931c06
SHA1: 8b783b113335946b5db104e20a4e6182259ccc28
SHA256: 11a8f947339d30605a086d0c8865366567767e0354baaf83a941c484b7cb297b
SSDeep: 24:gMFH2EoFK8zNj5Gg0Nb6IjHWXYqvxqGQVR+YfWnor1n4F5xlSAI/iCuR:gk2fFJNj4gej2XYUAGW5elSAIJ2
ImpHash: - 		Downloaded File
Unknown
2378505ba90d0efce5aad0e99f7404aeefea38e63d2143b55c36329a3b6f0565 MD5: 001f4bf3d1e7e548f9a84edf959c9d3b
SHA1: 6b4c77ed2707c61c9261a776d38d36db71612356
SHA256: 2378505ba90d0efce5aad0e99f7404aeefea38e63d2143b55c36329a3b6f0565
SSDeep: 6:qU9zpQWhfXHTYgbzjrJ9hEI3fX2rP1Qs3yDOUml:qoFQmH8gbzdvPw1T3yE
ImpHash: - 		Downloaded File
Unknown
2637cb9ee46cc3256cd8577abfc931afd12a96f9981b3fd5827227cf0ba12cd6 MD5: f0ee12fdb4639b948e5db810cffbcdf9
SHA1: 19fbe97f86062221d2f2f5f8f7c88bb62687fb34
SHA256: 2637cb9ee46cc3256cd8577abfc931afd12a96f9981b3fd5827227cf0ba12cd6
SSDeep: 3:zsm31FFTfIjvjlHDX3WDAMgVlRFR4TH0fjF5npVbeL1apsVeHy:ImNfIjhjX3cAMUNlfDpVbeJg0eS
ImpHash: - 		Downloaded File
Unknown
2e938bc4a4775df9b8d1200c344378e26384af7577fd8c2d382be2276671f74b MD5: abc9f7b977a37b2baf61d89b79abf6d5
SHA1: a672154e14fdadec89e313b2dfa9424b089e9f34
SHA256: 2e938bc4a4775df9b8d1200c344378e26384af7577fd8c2d382be2276671f74b
SSDeep: 49152:6en2yKE4qSAHe6786HdIlFrLCSVsVQ/MMRTbMaMk7HABNOz:Dn2zqSA+S866FyVUMad7gBNOz
ImpHash: - 		Downloaded File
Unknown
71f317489fbcb825c6bdf67306ec7bbfb0b633d36a3ed6fb3d98e41f013c0ae5 MD5: 4ce233ff9b0068e71fa5c462d9f0667d
SHA1: fb253aab6a23712337c741607625ff6bd2839356
SHA256: 71f317489fbcb825c6bdf67306ec7bbfb0b633d36a3ed6fb3d98e41f013c0ae5
SSDeep: 3:ytMdfeD8jTKNSKGl3pA4ovPxqg/S5EgeHosi6eS:ytcfI8CNYlZLovJqgYmv1
ImpHash: - 		Downloaded File
Unknown
8e1ae0723fecadc45d941aecb35a413a7d262fa8bb4a83a85a6a2a9b53b93867 MD5: 991ef62a831fe814065161224d2bc3c0
SHA1: 0a8ae73092012efe045614d256b6d13abddbb3c7
SHA256: 8e1ae0723fecadc45d941aecb35a413a7d262fa8bb4a83a85a6a2a9b53b93867
SSDeep: 3:fe0cglwRNrzwc4wPUyZLq1Rg0BJFjLfVpFvMBeWXGWn:fUuYzwRVR/BJFjvFvzQGW
ImpHash: - 		Downloaded File
Unknown
9cf8b440553c89e47b7a895540e1f03075b7f15bea22ae8a228133a7e0555006 MD5: c73f93d59b9391ac4b922aa97b6086dd
SHA1: aceac5aceba3ea8d9adc2d40d36fbfab445bbfbb
SHA256: 9cf8b440553c89e47b7a895540e1f03075b7f15bea22ae8a228133a7e0555006
SSDeep: 3:IuUKIc/1a1agcn1MNWQK7CvX/QKK/N9ngSnnxoQfTqJAOx8Llzu1hBVd2nwHd1yD:IuUbctD2NECHQKWngTQGlL2nwC/e2B
ImpHash: - 		Downloaded File
Unknown
C:\Users\aETAdzjz\186.exe MD5: 1ada9d6e0e7858c79e8fcfc6e4c385d2
SHA1: 446104d79d7658a61a3b9da2cec4094d670ce991
SHA256: 75c620faf2e8aaad8162ad086e48556233c578f5dbcc6d4a65d4982e94ff34c3
SSDeep: 12288:vKKHHuBLe0OVaImhgnXLBakHEKJcJpL/CDFhuksHpZ/s:vZH2hgnla2EKJcH/6+VY
ImpHash: - 		Access, Create, Delete, Write Downloaded File
Unknown
b76e9f86695cd63c763553bd860c3bf7918a7971160bc1bac7b054ad058f2648 MD5: b02489508f2ef9789b688e44a97bf8d6
SHA1: 355cc89ad955e588cea152b103a7c22c73bf036a
SHA256: b76e9f86695cd63c763553bd860c3bf7918a7971160bc1bac7b054ad058f2648
SSDeep: 6:5oWLKXyGV0aG4Cm7rZwLXgZB/Yr5jX3raNtxgt:5o6KXympXCm7r+L8wN3rcA
ImpHash: - 		Downloaded File
Unknown
bc695b3c606220452b883b30a00834c047a64a8f9fcd9345be7fe7dd80cb3d9a MD5: 3a5afdd64f6a8c1f7a8283ff79e2e916
SHA1: cda8cee7eb48d903075d897a0fc706cf7e1c1508
SHA256: bc695b3c606220452b883b30a00834c047a64a8f9fcd9345be7fe7dd80cb3d9a
SSDeep: 6:2Mo+Fu3TW8Vcuqm0eUS3lBSMLkXMb7aeA0:2H+4WycvmZUSP8Mx/
ImpHash: - 		Downloaded File
Unknown
c87760958d4fe8a3a8c51760f0fd445e65028fcfea3010263a59cd84e724cf15 MD5: ae7cdfbac191053906ebec37ebc852b1
SHA1: 880378824351f398e793ba2a917edf14f416dfd1
SHA256: c87760958d4fe8a3a8c51760f0fd445e65028fcfea3010263a59cd84e724cf15
SSDeep: 384:gN8TTnHp2aeaZ4m3rpmGNVNHt8dzSetZe2cvIMrSTPfA1SA7:nTzhP1mG5t8o2cvIM6Pff+
ImpHash: - 		Downloaded File
Unknown
ed0031bde979f0f8c7373c948c6383539e092da37c2fa5a1461ccf039c640143 MD5: ab978eeab8dba7ed010ad8e9e749d897
SHA1: be8f858c3425c15bae717e652a51b9638031450a
SHA256: ed0031bde979f0f8c7373c948c6383539e092da37c2fa5a1461ccf039c640143
SSDeep: 3:fe0cglwRNrzwc4wPUyZLq1Rg0BJFjLfLmvs9wviu+Uvxr+p:fUuYzwRVR/BJFj3mEFAvxr+p
ImpHash: - 		Downloaded File
Unknown
f80bef0f7aed816867b8c49775c3c387fdb22ce02caef5e59d3c2fe9b5abcaa5 MD5: 096025b556bcd4859a618818bf19c3b7
SHA1: 286458887efcf22a728873aee63140b6e389c7b9
SHA256: f80bef0f7aed816867b8c49775c3c387fdb22ce02caef5e59d3c2fe9b5abcaa5
SSDeep: 24:vilSWIJ8/3sHR/yHbNYlq5ET19eBNQmXdE493Ueui/QwN:atcIClqT/Qmn933X/r
ImpHash: - 		Downloaded File
Unknown
C:\Users\aETAdzjz\AppData\Local\Temp\D2A9.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3::
ImpHash: - 		Access, Create, Delete Dropped File
Not Queried
C:\Users\aETAdzjz\AppData\Local\sendduck\sendducka.exe MD5: 3290d6946b5e30e70414990574883ddb
SHA1: be0144e3235ffde0787e9f1cd34c828ec87d8e19
SHA256: 0e9294e1991572256b3cda6b031db9f39ca601385515ee59f1f601725b889663
SSDeep: 1536:4Dfm8/DhQ/65oIFM8oWcwnLUq0Sjw0hkFNaH3:G7Lm/6ohWc4oq0u7kn
ImpHash: 1f6cbfb8aa32847b01fd3e7e70d29d61 		Access, Create Dropped File
Whitelisted
C:\ - Access
Not Available
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL - Access
Not Available
C:\Users\ - Access
Not Available
C:\Users\aETAdzjz - Access
Not Available
C:\Users\aETAdzjz\AppData\ - Access
Not Available
C:\Users\aETAdzjz\AppData\Local\ - Access
Not Available
C:\Users\aETAdzjz\AppData\Local\Temp\VBE - Access, Create
Not Available
C:\Users\aETAdzjz\AppData\Local\attribnic\attribnic.exe - Access, Delete
Not Available
C:\Users\aETAdzjz\AppData\Local\sendduck\ - Access, Create
Not Available
C:\Users\aETAdzjz\AppData\Local\sendduck\sendduck.exe:Zone.Identifier - Access, Delete
Not Available
C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 - Access
Not Available
C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1 - Access
Not Available
C:\Windows - Access
Not Available
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config - Access, Read
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0 - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml - Access, Read
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.config - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml - Access
Not Available
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
Not Available
C:\Windows\system32 - Access
Not Available
C:\Windows\system32\alg.exe - Access
Not Available
Normal - Access
Not Available
System Paging File - Access
Not Available
Registry (155)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\DesignerFeatures Access
HKEY_CLASSES_ROOT\Clsid\{1C3B4210-F441-11CE-B9EA-00AA006B1A69} Access
HKEY_CLASSES_ROOT\Clsid\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\Control Access
HKEY_CLASSES_ROOT\Clsid\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{5CEF5610-713D-11CE-80C9-00AA00611080} Access
HKEY_CLASSES_ROOT\Clsid\{5CEF5610-713D-11CE-80C9-00AA00611080}\Control Access
HKEY_CLASSES_ROOT\Clsid\{5CEF5610-713D-11CE-80C9-00AA00611080}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{646BE917-EFED-46C6-AFC9-CA1FBD3C5100} Access
HKEY_CLASSES_ROOT\Clsid\{646BE917-EFED-46C6-AFC9-CA1FBD3C5100}\Control Access
HKEY_CLASSES_ROOT\Clsid\{646BE917-EFED-46C6-AFC9-CA1FBD3C5100}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{82B02373-B5BC-11CF-810F-00A0C9030074} Access
HKEY_CLASSES_ROOT\Clsid\{82B02373-B5BC-11CF-810F-00A0C9030074}\Control Access
HKEY_CLASSES_ROOT\Clsid\{82B02373-B5BC-11CF-810F-00A0C9030074}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{82B02374-B5BC-11CF-810F-00A0C9030074} Access
HKEY_CLASSES_ROOT\Clsid\{82B02374-B5BC-11CF-810F-00A0C9030074}\Control Access
HKEY_CLASSES_ROOT\Clsid\{82B02374-B5BC-11CF-810F-00A0C9030074}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{82B02375-B5BC-11CF-810F-00A0C9030074} Access
HKEY_CLASSES_ROOT\Clsid\{82B02375-B5BC-11CF-810F-00A0C9030074}\Control Access
HKEY_CLASSES_ROOT\Clsid\{82B02375-B5BC-11CF-810F-00A0C9030074}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{8A683C92-BA84-11CF-8110-00A0C9030074} Access
HKEY_CLASSES_ROOT\Clsid\{8A683C92-BA84-11CF-8110-00A0C9030074}\Control Access
HKEY_CLASSES_ROOT\Clsid\{8A683C92-BA84-11CF-8110-00A0C9030074}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{8A683C93-BA84-11CF-8110-00A0C9030074} Access
HKEY_CLASSES_ROOT\Clsid\{8A683C93-BA84-11CF-8110-00A0C9030074}\Control Access
HKEY_CLASSES_ROOT\Clsid\{8A683C93-BA84-11CF-8110-00A0C9030074}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{909E0AE0-16DC-11CE-9E98-00AA00574A4F} Access
HKEY_CLASSES_ROOT\Clsid\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}\Control Access
HKEY_CLASSES_ROOT\Clsid\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{AFC20920-DA4E-11CE-B943-00AA006887B4} Access
HKEY_CLASSES_ROOT\Clsid\{AFC20920-DA4E-11CE-B943-00AA006887B4}\Control Access
HKEY_CLASSES_ROOT\Clsid\{AFC20920-DA4E-11CE-B943-00AA006887B4}\Insertable Access
HKEY_CLASSES_ROOT\Clsid\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32 Access
HKEY_CLASSES_ROOT\Clsid\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32\ThreadingModel Access, Read
HKEY_CLASSES_ROOT\Clsid\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\Instance CLSID Access, Read
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Access, Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2 Access
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9 Access
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4} Access
HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CLASSES_ROOT\Typelib Access
HKEY_CLASSES_ROOT\Typelib\{0D452EE1-E08F-101A-852E-02608C4D0BB4} Access
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Control Panel\International\Geo Access
HKEY_CURRENT_USER\Environment Access
HKEY_CURRENT_USER\Environment\PSMODULEPATH Access, Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Access, Create
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sendduck Access, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access, Create
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\AlignToGrid Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackgroundProjectLoad Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CollapseWindows Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CtlsShowSelected Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\Designers Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\Dock Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\DsnShowSelected Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\FolderView Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\GridHeight Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\GridWidth Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\MainWindow Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\MdiMaximized Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\PropertiesWindow Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\ReadOnlyMode Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\SaveBeforeRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\ShowGrid Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\ShowToolTips Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\Tool Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\ToolboxControls Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\UI Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\UpgradeVBX Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\VBE\6.0\Addins64 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetConnectDisconnect Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\path Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\PipelineMaxStackSizeMB Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\StackVersion Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook Access, Create
HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook\DLLPathEx Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine\ApplicationBase Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting\Default Impersonation Level Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting\Default Namespace Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PSMODULEPATH Access, Read
HKEY_PERFORMANCE_DATA Access
Mutex (4)
»
Mutex Name Operations
Global\.net clr networking Access
Global\I705BA84C Access
Global\M705BA84C Access
Global\Nx513464FA Access
Domain (32)
»
Domain Sources Severity
118.165.222.95.b.barracudacentral.org Function Log
Unknown
118.165.222.95.bl.mailspike.net Function Log
Unknown
118.165.222.95.spam.abuse.ch Function Log
Unknown
118.165.222.95.spam.dnsbl.sorbs.net Function Log
Unknown
118.165.222.95.zen.spamhaus.org Function Log
Unknown
edogawa-juukou.sakura.ne.jp PCAP, Function Log
Unknown
fra-efz.ms-acdc.office.com PCAP, Function Log
Unknown
imaps.bbiq.jp PCAP, Function Log
Unknown
kopt-eonet-smtp.xspmail.jp PCAP, Function Log
Unknown
mail.accountsupport.com PCAP, Function Log
Unknown
mail.eiz.org.zm PCAP, Function Log
Unknown
mail.emirates.net.ae PCAP, Function Log
Unknown
mail.gmoserver.jp PCAP, Function Log
Unknown
mail.h.dion.ne.jp PCAP, Function Log
Unknown
mail.kotobukiseishi.com PCAP, Function Log
Unknown
mail.lolipop.jp PCAP, Function Log
Unknown
mail.obiyama.net PCAP, Function Log
Unknown
mail.ocn.ne.jp PCAP, Function Log
Unknown
mail.sollatek.com.ng PCAP, Function Log
Unknown
mail1.mailone.co.ug PCAP, Function Log
Unknown
marcelsourcing.com PCAP, Function Log
Unknown
outlook.ms-acdc.office.com PCAP, Function Log
Unknown
outlook.office365.com PCAP, Function Log
Unknown
pmaila.emirates.net.ae PCAP, Function Log
Unknown
pop-mail.outlook.com PCAP, Function Log
Unknown
pop.ocn.ne.jp PCAP, Function Log
Unknown
pop.ufjapan.co.jp PCAP, Function Log
Unknown
smtp.eonet.ne.jp PCAP, Function Log
Unknown
smtp.mail.me.com PCAP, Function Log
Unknown
smtp.mail.me.com.akadns.net PCAP, Function Log
Unknown
smtp.ocn.ne.jp PCAP, Function Log
Unknown
z-imapv.bbiq.jp PCAP, Function Log
Unknown
URL (7)
»
URL Operations Category Severity
68.114.229.171/5ACllPCVPT6 POST Contacted
Unknown
68.114.229.171/CxquLkE590eo POST Contacted
Unknown
91.205.215.10/dVvhyK8JpL6WvugLB1 POST Contacted
Unknown
91.236.4.234/Ct6HhqaiPaLu3sf POST Contacted
Unknown
91.236.4.234/PCnuDUzoPUMZ5ZV6rs6 POST Contacted
Unknown
91.236.4.234/XLbHjszcqzsbSkcUmf POST Contacted
Unknown
http://marcelsourcing.com/wp-content/18/ GET Contacted
Unknown
IP (44)
»
IP Protocols Sources
114.147.58.6 DNS PCAP, Function Log
114.147.58.70 DNS, TCP PCAP, Function Log
118.23.109.27 DNS PCAP, Function Log
118.23.178.134 DNS PCAP, Function Log
118.23.178.207 DNS PCAP, Function Log
118.23.185.144 DNS PCAP, Function Log
153.122.21.33 DNS, TCP PCAP, Function Log
153.138.213.134 DNS PCAP, Function Log
153.138.213.135 DNS PCAP, Function Log
153.138.213.150 DNS PCAP, Function Log
153.138.213.151 DNS PCAP, Function Log
153.138.216.150 DNS PCAP, Function Log
153.138.216.151 DNS PCAP, Function Log
153.138.219.38 DNS, TCP PCAP, Function Log
153.138.219.39 DNS PCAP, Function Log
153.149.231.65 DNS PCAP, Function Log
153.149.232.193 DNS, TCP PCAP, Function Log
157.7.106.218 DNS, TCP PCAP, Function Log
157.7.144.7 DNS, TCP PCAP, Function Log
162.215.253.110 DNS, TCP PCAP, Function Log
17.36.205.74 DNS, TCP PCAP, Function Log
195.229.241.219 DNS, TCP PCAP, Function Log
198.71.233.68 DNS, TCP, HTTP PCAP, Function Log
202.228.219.206 DNS, TCP PCAP, Function Log
202.238.198.30 DNS, TCP PCAP, Function Log
210.252.58.87 DNS, TCP PCAP, Function Log
219.94.163.51 DNS, TCP PCAP, Function Log
41.220.13.12 DNS, TCP PCAP, Function Log
41.60.193.71 DNS, TCP PCAP, Function Log
52.97.188.66 DNS PCAP, Function Log
52.97.189.98 DNS, TCP PCAP, Function Log
52.97.232.210 DNS PCAP, Function Log
65.254.254.50 DNS PCAP, Function Log
65.254.254.51 DNS PCAP, Function Log
65.254.254.52 DNS PCAP, Function Log
65.254.254.53 DNS, TCP PCAP, Function Log
65.254.254.54 DNS PCAP, Function Log
65.254.254.55 DNS PCAP, Function Log
65.254.254.56 DNS PCAP, Function Log
65.254.254.58 DNS PCAP, Function Log
68.114.229.171 TCP, HTTP PCAP, Function Log
86.96.229.28 DNS PCAP, Function Log
91.205.215.10 TCP, HTTP PCAP, Function Log
91.236.4.234 TCP, HTTP PCAP, Function Log
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image