303ad8c1...029a | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Keylogger, Spyware, Downloader, Trojan, Banking Trojan

xuzyww.doc

Word Document

Created at 2019-11-14T09:18:00

...

Remarks (1/1)

(0x200000e): The overall sleep time of all monitored processes was truncated from "12 seconds" to "10 seconds" to reveal dormant functionality.

Indicators

File (51)
»
Filename Hash Operations Category
MD5: dc0fa5ccd45eacf5863cca0ad142e447
SHA1: 6e6770a03a3cb4a1a1df25bc6d37c23a71a26bf6
SHA256: d592b31a833ea3a26843a69078cf610dd56f175677bc0a3e79d537cbe1b8ad70
SSDeep: 12288:HV64/cqCH8lSxkIgIfOR6j5GmhOngOYL0pt3A2G:H84/cp8kxk6f+6QmI5P3
ImpHash: None 		Access, Create Memory Dump
\\.\mailslot\sl64 - Access, Write
\\.\pipe\{CE377949-D5DC-3008-CFE2-D96473361DD8} - Access, Read, Write
C:\ - Access
C:\Users - Access
C:\Users\aETAdzjz - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\cache\data_0 - Access, Delete
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\cache\data_1 - Access, Delete
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\cache\data_2 - Access, Delete
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\cache\data_3 - Access, Delete
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\cache\index - Access, Delete
C:\Users\aETAdzjz\AppData\Local\Temp\1320.bi1 MD5: ef8fd8948825bfa3bd8422d6b1a669b2
SHA1: 8d285f4bc1c1dc82c1148602df3d93d76e57a0dc
SHA256: c1d396f73f54a6cfd4301a8fce8d2e94aba01fd396d92897847151513a2429cd
SSDeep: 3:cPLgeqnhARtt7TSjjhThARtmQLXXXLKSLEt11/v:o0eqnWbtChWbnLXXXLKSYx/v
ImpHash: None 		Access, Create, Read, Delete Dropped File
C:\Users\aETAdzjz\AppData\Local\Temp\1320.tmp - Access, Create
C:\Users\aETAdzjz\AppData\Local\Temp\CDFD.bin MD5: 6bc4fa61b013340783e5fd3f7221fe80
SHA1: a706d693eabcc9c13dfc31c6f3f4e79d513a4264
SHA256: bedd441ee7ea62f7387f4afbb11487ef3fba0a8ed929142f763baaf4162f89de
SSDeep: 12:Jw/fADe08AWyHurHiR7Tv7/HurHSR7P7v:vyy37/b7v
ImpHash: None 		Access, Create, Read, Write, Delete Dropped File
C:\Users\aETAdzjz\AppData\Local\Temp\CDFD.tmp - Access, Create
C:\Users\aETAdzjz\AppData\Local\Temp\E3A6.bin MD5: 32bcb7b01b57de70fa2a93d38b5b99fd
SHA1: a5ff11ec560d61564c47a1a03a12d78d67646efa
SHA256: edeeabad894a37ae4189f1d30ebd8265bf91a0783b32dda9878ba5669844be19
SSDeep: 6:5jXM2siiIPu8CnY9JZF7FFMSrczZdllv8MCEujGec7PlpSbBMV/xt+kZl+l9:5jXM2sifIYD1WSw3Lv8MOjGL7Plp8S5Y
ImpHash: None 		Access, Create, Write Dropped File
C:\Users\aETAdzjz\AppData\Local\Temp\E3A6.tmp - Access, Create
C:\Users\aETAdzjz\AppData\Local\Temp\VBE - Access, Create
C:\Users\aETAdzjz\AppData\Local\Temp\Word8.0 - Access, Create
C:\Users\aETAdzjz\AppData\Roaming\Microsoft - Access, Create
C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Crypore6 - Access, Create
C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Crypore6\bdeskmgr.dll MD5: f64076fe8eef1bac743a54af32b42671
SHA1: a6cf6d28d3a35d4ce8de8e7a5f0d85a1bb923bbc
SHA256: ce8e158c2c30a8641d6ff7838adbff96c0e592f885b2dbdd382266555fb032a4
SSDeep: 12288:1VtF21kgh6j10JGCDn3NVEoYFA5rId7ipJC:1VtEjcMfTpYC5cmHC
ImpHash: None 		Access, Create, Write Dropped File
C:\Users\aETAdzjz\AppData\Roaming\Microsoft\{F5FB2C3C-D05C-EF89-82F9-0493D63D7877} - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\prefs.js MD5: 64c662633aaa9e4a880c44701c01e59e
SHA1: 572cafce1a3aa6ce28f3905591629280d5bb814c
SHA256: bd7ed14a8f197e8c0b4690a2c2aa75343aba96634f9fb3c0e541d2658ca4bd7f
SSDeep: 96:5W3tkMNqizJzzYOs1SZGN4Y+VB4ljZUbFos5oF5p809mglJK9FIQJM:wdkMYG7tl5Wf809m2J2FIQJM
ImpHash: None 		Access, Create, Read, Write Modified File
C:\Users\aETAdzjz\AppData\Roaming/system64.dll - Access
C:\Users\aETAdzjz\AvGcpVlPprpjYv.bin MD5: 5016784605ad3fd883fbdfdd5fbd469f
SHA1: 30100663d3d88d7399948f7f92602efcb70b5a86
SHA256: 14d4db1adde49001f81cb670a60f9d40fc7dea4b96cd77029ca87b44ccb586c8
SSDeep: 12288:INVtF21kgh6j10JGCDn3NVEoYFA5rId7ipJC:INVtEjcMfTpYC5cmHC
ImpHash: None 		Access, Create, Read, Write, Delete Downloaded File
C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 - Access
C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1 - Access
C:\Windows - Access
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config - Access, Read
C:\Windows\System32 - Access
C:\Windows\system32\c_1252.nls - Access
C:\Windows\SYSTEM32\ntdll.dll - Access, Read
C:\Windows\system32\regsvr32.exe - Access
C:\Windows\System32\WindowsPowerShell\v1.0 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config - Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml - Access, Read
Normal - Access
Registry (194)
»
Registry Key Name Operations
Application Access
Application\PowerShell Access
HKEY_CLASSES_ROOT Access
HKEY_CLASSES_ROOT\.bin Access, Read
HKEY_CLASSES_ROOT\AutoRegister Access
HKEY_CLASSES_ROOT\CLSID Access
HKEY_CLASSES_ROOT\CLSID\{E5CA59F5-57C4-4DD8-9BD6-1DEEEDD27AF4} Access
HKEY_CLASSES_ROOT\CLSID\{E5CA59F5-57C4-4DD8-9BD6-1DEEEDD27AF4}\TypeLib Access, Read
HKEY_CLASSES_ROOT\CLSID\{E5CA59F5-57C4-4DD8-9BD6-1DEEEDD27AF4}\Version Access, Read
HKEY_CLASSES_ROOT\Clsid\{E5CA59F5-57C4-4DD8-9BD6-1DEEEDD27AF4} Access
HKEY_CLASSES_ROOT\Clsid\{E5CA59F5-57C4-4DD8-9BD6-1DEEEDD27AF4}\Control Access
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Access, Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2 Access
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9 Access
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.2\9\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{8405D0DF-9FDD-4829-AEAD-8E2B0A18FEA4} Access
HKEY_CLASSES_ROOT\TypeLib\{8405D0DF-9FDD-4829-AEAD-8E2B0A18FEA4}\1.0 Access
HKEY_CLASSES_ROOT\TypeLib\{8405D0DF-9FDD-4829-AEAD-8E2B0A18FEA4}\1.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{8405D0DF-9FDD-4829-AEAD-8E2B0A18FEA4}\1.0\0\win32 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{8405D0DF-9FDD-4829-AEAD-8E2B0A18FEA4}\1.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\Typelib Access
HKEY_CLASSES_ROOT\Typelib\{8405D0DF-9FDD-4829-AEAD-8E2B0A18FEA4} Access
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Environment Access
HKEY_CURRENT_USER\Environment\PSMODULEPATH Access, Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableSPDY3_0 Access, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580 Access, Create
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Client Access, Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Client32 Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Client64 Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Config Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Files Access, Create
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Files\E1317AC5E1EBDE4D0E Access, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Ini Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Keys Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Kill Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\LastTask Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Run Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Scr Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\TorClient Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\apiMM1M0 Access, Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\{70017650-0FA6-225C-19A4-B3765D18970A} Access, Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\{E12FFA4A-CC07-BBA0-DEA5-C01FF2A9F4C3} Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\ Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\0a0d020000000000c000000000000046 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\189cba75c69c634996739bac92103ebb Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\1a8bd43e654f65418fbafadeef063a57 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\1cfb96c6c96b454ebff73da2e9f63f51 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\3517490d76624c419a828607e2a54604 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\467888fc50a6c6448d6cc0cf7b5307d6 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\48dea081c9634a43a6861907855add5c Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\55aad8d134512d438564aa678cb92d66 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\71b0295bef58e344911262b243f005ac Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\8503020000000000c000000000000046 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\9207f3e0a3b11019908b08002b2a56c2 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\9375CFF0413111d3B88A00104B2A6676 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\9375CFF0413111d3B88A00104B2A6676\00000001 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\9375CFF0413111d3B88A00104B2A6676\00000002 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\9375CFF0413111d3B88A00104B2A6676\00000003 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\\f86ed2903a4a11cfb57e524153480001 Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access, Create
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\AutoIndent Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\AutoQuickTips2 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\AutoStatement2 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\AutoValueTips2 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CodeBackColors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CodeForeColors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\DragDropInEditor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\EndProcLine Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\FontCharSet Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\FontFace Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\FontHeight Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\FullModuleView Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\IndicatorBar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\IndicatorColors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\OBGroupMembers Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\OBSearchHeight Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\SyntaxChecking Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\TabWidth Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail Access
HKEY_CURRENT_USER\Software\Microsoft\Windows Mail Access
HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Salt Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Store Root Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\apiMM1M0 Access, Read, Write
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\DisableOrpcDebugging7 Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\StackVersion Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine\ApplicationBase Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\StackVersion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\WAB\DLLPath Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PSMODULEPATH Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\DNSLookupOrder Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\DhcpDomain Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\DhcpSearchList Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Domain Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\SearchList Access, Read
HKEY_PERFORMANCE_DATA Access
HKEY_USERS Access
HKEY_USERS\S-1-5-21-2345716840-1148442690-1481144037-1000\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580 Access, Create
HKEY_USERS\S-1-5-21-2345716840-1148442690-1481144037-1000\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Client Access, Read
HKEY_USERS\S-1-5-21-2345716840-1148442690-1481144037-1000\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Client32 Access, Write
HKEY_USERS\S-1-5-21-2345716840-1148442690-1481144037-1000\Software\AppDataLow\Software\Microsoft\3632F5D8-1D04-D8B6-57CA-A18C7B9E6580\Client64 Access, Write
HKEY_USERS\S-1-5-21-2345716840-1148442690-1481144037-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Access
HKEY_USERS\S-1-5-21-2345716840-1148442690-1481144037-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData Access, Read
HardwareEvents Access
HardwareEvents\PowerShell Access
Internet Explorer Access
Internet Explorer\PowerShell Access
Key Management Service Access
Key Management Service\PowerShell Access
Media Center Access
Media Center\PowerShell Access
OAlerts Access
OAlerts\PowerShell Access
Security Access
System Access
System\PowerShell Access
Windows PowerShell Access
Windows PowerShell\PowerShell Access
Mutex (8)
»
Mutex Name Operations
Global\.net clr networking Access, Delete
Local\{6A5E21FF-C1FA-2C95-9B3E-8520FF528954} Access
Local\{722AD44B-2987-7426-43C6-6DE8275AF19C} Access, Delete
Local\{FCF9E212-2B0D-8EC0-95F0-8FA2992433F6} Access, Delete
{5E6EC9EA-2502-40CD-9F72-297443C66DE8} Access
{76F64C5E-5D7B-1845-970A-E1CCBBDEA5C0} Access
{82FB0C97-F984-04EA-93D6-3D78776AC12C} Access
{AE7A4847-3582-10AE-2FC2-3944D3167DB8} Access
Domain (5)
»
Domain Sources
ron4law.com PCAP, Function Log
resolver1.opendns.com PCAP, Function Log
intraders-support.at PCAP, Function Log
google.com Function Log
myip.opendns.com PCAP
URL (3)
»
URL Operations Category
http://ron4law.com/Drsstor.bin GET Contacted
intraders-support.at/images/WuRSBbFjG0pj4JYX/sI9w9BOQXLr3cLM/XlHwDGrmmUX0zOgbax/ErFjlom80/AtqNswhjrTQnZ3YzXnrJ/LD2QqgHYZH_2B698KzS/53rWacE7F5jTyV8MJJpkou/VKuF5nMFkMYQM/tr4dC4JP/_2B0y226Hm5e3CQhFHDjQ6U/InrIIHsi1_2F/4e.gif GET Contacted
google.com/ GET Contacted
IP (15)
»
IP Protocols Sources
50.87.144.227 DNS, HTTP, TCP PCAP, Function Log
208.67.222.222 DNS, UDP PCAP, Function Log
17.57.146.20 TCP PCAP
78.31.63.30 DNS, HTTPS, TCP PCAP, Function Log
31.5.167.149 DNS, HTTPS, TCP PCAP, Function Log
46.214.214.39 DNS, HTTPS, TCP PCAP, Function Log
89.215.156.222 DNS, HTTPS, TCP PCAP, Function Log
62.121.105.162 DNS, HTTPS, TCP PCAP, Function Log
89.133.228.92 DNS, HTTPS, TCP PCAP, Function Log
37.34.176.37 DNS, HTTPS, TCP PCAP, Function Log
89.17.225.163 DNS, HTTPS, TCP PCAP, Function Log
62.141.241.11 DNS, HTTPS, TCP PCAP, Function Log
89.190.74.198 DNS, HTTPS, TCP PCAP, Function Log
172.217.21.238 HTTPS, TCP Function Log, PCAP
95.222.167.189 DNS PCAP, Function Log
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image