Unpacked Pony | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Spyware

c71c3662a7ebba5fdd0d804fe9ff864789fa08e8286352c21b339b9db2c3db81 (SHA256)

p.exe

Windows Exe (x86-32)

Created at 2018-09-11 15:34:00

...

Indicators

File (81)
»
Filename Hash Operations Source
C:\Program Files (x86)\CuteFTP\sm.dat - Access
C:\Program Files (x86)\GlobalSCAPE\CuteFTP Lite\sm.dat - Access
C:\Program Files (x86)\GlobalSCAPE\CuteFTP Pro\sm.dat - Access
C:\Program Files (x86)\GlobalSCAPE\CuteFTP\sm.dat - Access
C:\ProgramData\CoffeeCup Software\SharedSettings.ccs - Access
C:\ProgramData\CoffeeCup Software\SharedSettings.sqlite - Access
C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.ccs - Access
C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.sqlite - Access
C:\ProgramData\CuteFTP\sm.dat - Access
C:\ProgramData\ExpanDrive\drives.js - Access
C:\ProgramData\FileZilla\filezilla.xml - Access
C:\ProgramData\FileZilla\recentservers.xml - Access
C:\ProgramData\FileZilla\sitemanager.xml - Access
C:\ProgramData\FlashFXP\3\History.dat - Access
C:\ProgramData\FlashFXP\3\Quick.dat - Access
C:\ProgramData\FlashFXP\3\Sites.dat - Access
C:\ProgramData\FlashFXP\4\History.dat - Access
C:\ProgramData\FlashFXP\4\Quick.dat - Access
C:\ProgramData\FlashFXP\4\Sites.dat - Access
C:\ProgramData\GHISLER\wcx_ftp.ini - Access
C:\ProgramData\GlobalSCAPE\CuteFTP Lite\sm.dat - Access
C:\ProgramData\GlobalSCAPE\CuteFTP Pro\sm.dat - Access
C:\ProgramData\GlobalSCAPE\CuteFTP\sm.dat - Access
C:\ProgramData\SharedSettings.ccs - Access
C:\ProgramData\SharedSettings.sqlite - Access
C:\ProgramData\SharedSettings_1_0_5.ccs - Access
C:\ProgramData\SharedSettings_1_0_5.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Local\CoffeeCup Software\SharedSettings.ccs - Access
C:\Users\Nd9E1FYi\AppData\Local\CoffeeCup Software\SharedSettings.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Local\CoffeeCup Software\SharedSettings_1_0_5.ccs - Access
C:\Users\Nd9E1FYi\AppData\Local\CoffeeCup Software\SharedSettings_1_0_5.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Local\CuteFTP\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\ExpanDrive\drives.js - Access
C:\Users\Nd9E1FYi\AppData\Local\FileZilla\filezilla.xml - Access
C:\Users\Nd9E1FYi\AppData\Local\FileZilla\recentservers.xml - Access
C:\Users\Nd9E1FYi\AppData\Local\FileZilla\sitemanager.xml - Access
C:\Users\Nd9E1FYi\AppData\Local\FlashFXP\3\History.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\FlashFXP\3\Quick.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\FlashFXP\3\Sites.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\FlashFXP\4\History.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\FlashFXP\4\Quick.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\FlashFXP\4\Sites.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\GHISLER\wcx_ftp.ini - Access
C:\Users\Nd9E1FYi\AppData\Local\GlobalSCAPE\CuteFTP Lite\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\GlobalSCAPE\CuteFTP Pro\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\GlobalSCAPE\CuteFTP\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Local\Google\Chrome\User Data\Default\Login Data - Access, Read
C:\Users\Nd9E1FYi\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal - Access, Read
C:\Users\Nd9E1FYi\AppData\Local\Google\Chrome\User Data\Default\Web Data - Access, Read
C:\Users\Nd9E1FYi\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal - Access, Read
C:\Users\Nd9E1FYi\AppData\Local\SharedSettings.ccs - Access
C:\Users\Nd9E1FYi\AppData\Local\SharedSettings.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Local\SharedSettings_1_0_5.ccs - Access
C:\Users\Nd9E1FYi\AppData\Local\SharedSettings_1_0_5.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Local\Temp\HWID - Access
C:\Users\Nd9E1FYi\AppData\Roaming\CoffeeCup Software\SharedSettings.ccs - Access
C:\Users\Nd9E1FYi\AppData\Roaming\CoffeeCup Software\SharedSettings.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.ccs - Access
C:\Users\Nd9E1FYi\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Roaming\CuteFTP\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\ExpanDrive\drives.js - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FileZilla\filezilla.xml - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FileZilla\recentservers.xml - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FileZilla\sitemanager.xml - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FlashFXP\3\History.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FlashFXP\3\Quick.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FlashFXP\3\Sites.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FlashFXP\4\History.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FlashFXP\4\Quick.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\FlashFXP\4\Sites.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\GHISLER\wcx_ftp.ini - Access
C:\Users\Nd9E1FYi\AppData\Roaming\GlobalSCAPE\CuteFTP Lite\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\GlobalSCAPE\CuteFTP Pro\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\GlobalSCAPE\CuteFTP\sm.dat - Access
C:\Users\Nd9E1FYi\AppData\Roaming\SharedSettings.ccs - Access
C:\Users\Nd9E1FYi\AppData\Roaming\SharedSettings.sqlite - Access
C:\Users\Nd9E1FYi\AppData\Roaming\SharedSettings_1_0_5.ccs - Access
C:\Users\Nd9E1FYi\AppData\Roaming\SharedSettings_1_0_5.sqlite - Access
C:\Users\Nd9E1FYi\wcx_ftp.ini - Access
C:\Windows\32BitFtp.ini - Access
C:\Windows\wcx_ftp.ini - Access
Registry (230)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32 Access
HKEY_CLASSES_ROOT\FTP++.Link\shell\open\command Access
HKEY_CLASSES_ROOT\Opera.HTML\shell\open\command Access
HKEY_CURRENT_USER\Identities Access
HKEY_CURRENT_USER\SOFTWARE\LeapWare Access
HKEY_CURRENT_USER\SOFTWARE\NCH Software\Fling\Accounts Access
HKEY_CURRENT_USER\SOFTWARE\Robo-FTP 3.7\FTPServers Access
HKEY_CURRENT_USER\SOFTWARE\Robo-FTP 3.7\Scripts Access
HKEY_CURRENT_USER\Software\AceBIT Access
HKEY_CURRENT_USER\Software\Adobe\Common Access
HKEY_CURRENT_USER\Software\BPFTP Access
HKEY_CURRENT_USER\Software\BPFTP\Bullet Proof FTP\Main Access
HKEY_CURRENT_USER\Software\BPFTP\Bullet Proof FTP\Options Access
HKEY_CURRENT_USER\Software\BulletProof Software\BulletProof FTP Client\Main Access
HKEY_CURRENT_USER\Software\BulletProof Software\BulletProof FTP Client\Options Access
HKEY_CURRENT_USER\Software\ChromePlus Access
HKEY_CURRENT_USER\Software\CoffeeCup Software Access
HKEY_CURRENT_USER\Software\CoffeeCup Software\Internet\Profiles Access
HKEY_CURRENT_USER\Software\Cryer\WebSitePublisher Access
HKEY_CURRENT_USER\Software\ExpanDrive Access
HKEY_CURRENT_USER\Software\ExpanDrive\Sessions Access
HKEY_CURRENT_USER\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224 Access
HKEY_CURRENT_USER\Software\FTP Explorer\Profiles Access
HKEY_CURRENT_USER\Software\FTPClient\Sites Access
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites Access
HKEY_CURRENT_USER\Software\Far Manager\Plugins\FTP\Hosts Access
HKEY_CURRENT_USER\Software\Far Manager\SavedDialogHistory\FTPHost Access
HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts Access
HKEY_CURRENT_USER\Software\Far2\SavedDialogHistory\FTPHost Access
HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts Access
HKEY_CURRENT_USER\Software\Far\SavedDialogHistory\FTPHost Access
HKEY_CURRENT_USER\Software\FileZilla Access
HKEY_CURRENT_USER\Software\FileZilla Client Access
HKEY_CURRENT_USER\Software\FlashFXP Access
HKEY_CURRENT_USER\Software\FlashFXP\3 Access
HKEY_CURRENT_USER\Software\FlashFXP\4 Access
HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings Access
HKEY_CURRENT_USER\Software\Ghisler\Total Commander Access
HKEY_CURRENT_USER\Software\Ghisler\Windows Commander Access
HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar Access
HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar Access
HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar Access
HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar Access
HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar Access
HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar Access
HKEY_CURRENT_USER\Software\IncrediMail Access
HKEY_CURRENT_USER\Software\LeechFTP Access
HKEY_CURRENT_USER\Software\LinasFTP\Site Manager Access
HKEY_CURRENT_USER\Software\MAS-Soft\FTPInfo\Setup Access
HKEY_CURRENT_USER\Software\Martin Prikryl Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 Access
HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Access
HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail Access
HKEY_CURRENT_USER\Software\Microsoft\Windows Mail Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Access
HKEY_CURRENT_USER\Software\Mozilla Access
HKEY_CURRENT_USER\Software\Mozilla\Firefox Access
HKEY_CURRENT_USER\Software\Mozilla\Firefox\PathToExe Read
HKEY_CURRENT_USER\Software\Mozilla\Firefox\TaskBarIDs Access
HKEY_CURRENT_USER\Software\Mozilla\Firefox\TaskBarIDs\PathToExe Read
HKEY_CURRENT_USER\Software\Mozilla\PathToExe Read
HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts Access
HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\FTP Access
HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\mru\jobs Access
HKEY_CURRENT_USER\Software\Opera Software Access
HKEY_CURRENT_USER\Software\Poco Systems Inc Access
HKEY_CURRENT_USER\Software\RIT\The Bat! Access
HKEY_CURRENT_USER\Software\RIT\The Bat!\Users depot Access
HKEY_CURRENT_USER\Software\RimArts\B2\Settings Access
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions Access
HKEY_CURRENT_USER\Software\SoftX.org\FTPClient\Sites Access
HKEY_CURRENT_USER\Software\Sota\FFFTP Access
HKEY_CURRENT_USER\Software\Sota\FFFTP\Options Access
HKEY_CURRENT_USER\Software\South River Technologies\WebDrive\Connections Access
HKEY_CURRENT_USER\Software\TurboFTP Access
HKEY_CURRENT_USER\Software\VanDyke\SecureFX Access
HKEY_CURRENT_USER\Software\WinRAR Access
HKEY_CURRENT_USER\Software\WinRAR\HWID Read, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32 Access
HKEY_LOCAL_MACHINE\SOFTWARE\LeapWare Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D82C954-2957-418B-908F-FE78BF3A8BEB} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D82C954-2957-418B-908F-FE78BF3A8BEB}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D82C954-2957-418B-908F-FE78BF3A8BEB}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-0804-1033-1959-001824214663} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-0804-1033-1959-001824214663}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-0804-1033-1959-001824237067} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-0804-1033-1959-001824237067}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-0804-1033-1959-001824237067}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f} Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f}\DisplayName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f}\UninstallString Read
HKEY_LOCAL_MACHINE\SOFTWARE\NCH Software\Fling\Accounts Access
HKEY_LOCAL_MACHINE\SOFTWARE\Robo-FTP 3.7\FTPServers Access
HKEY_LOCAL_MACHINE\SOFTWARE\Robo-FTP 3.7\Scripts Access
HKEY_LOCAL_MACHINE\Software\AceBIT Access
HKEY_LOCAL_MACHINE\Software\CoffeeCup Software Access
HKEY_LOCAL_MACHINE\Software\FTPClient\Sites Access
HKEY_LOCAL_MACHINE\Software\FileZilla Access
HKEY_LOCAL_MACHINE\Software\FileZilla Client Access
HKEY_LOCAL_MACHINE\Software\FlashFXP Access
HKEY_LOCAL_MACHINE\Software\FlashFXP\3 Access
HKEY_LOCAL_MACHINE\Software\FlashFXP\4 Access
HKEY_LOCAL_MACHINE\Software\Ghisler\Total Commander Access
HKEY_LOCAL_MACHINE\Software\Ghisler\Windows Commander Access
HKEY_LOCAL_MACHINE\Software\IncrediMail Access
HKEY_LOCAL_MACHINE\Software\Martin Prikryl Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Account Manager Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Account Manager\Outlook Read
HKEY_LOCAL_MACHINE\Software\Mozilla Access
HKEY_LOCAL_MACHINE\Software\Mozilla\PathToExe Read
HKEY_LOCAL_MACHINE\Software\NCH Software\ClassicFTP\FTPAccounts Access
HKEY_LOCAL_MACHINE\Software\Nico Mak Computing\WinZip\FTP Access
HKEY_LOCAL_MACHINE\Software\Nico Mak Computing\WinZip\mru\jobs Access
HKEY_LOCAL_MACHINE\Software\Poco Systems Inc Access
HKEY_LOCAL_MACHINE\Software\RIT\The Bat! Access
HKEY_LOCAL_MACHINE\Software\RIT\The Bat!\Users depot Access
HKEY_LOCAL_MACHINE\Software\RimArts\B2\Settings Access
HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions Access
HKEY_LOCAL_MACHINE\Software\SoftX.org\FTPClient\Sites Access
HKEY_LOCAL_MACHINE\Software\South River Technologies\WebDrive\Connections Access
HKEY_LOCAL_MACHINE\Software\TurboFTP Access
Domain (1)
»
Domain Sources
ipv4only.arpa PCAP
IP (1)
»
IP Protocols Sources
192.0.0.170 UDP PCAP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image