Select
Select
Select
Network routing through dirty line or VPN

Syntax is option1=val1,option2=val2,option3=val3, etc.

Option Description
force-sleepskip Override default sleep skipping behavior: 0 disables all sleep skipping, 1 skips all sleeps.
full-logs By default, logs prior to network activity for URL analyses and prior to access of the file in question for non-executable formats are suppressed. Set to 1 to disable log suppression.
force-flush For performance reasons, logs are buffered before being sent back to the result server. We make every attempt to flush the buffer at critical points including when exceptions occur, but in some rare termination scenarios, logs may be lost. Set to 1 to force flushing of the log buffers after any non-duplicate API is called, set to 2 to force flushing of every log.
no-stealth Set to 1 to disable anti-anti-VM/sandbox code enabled by default.
buffer-max When set to an integer of your choice, changes the maximum number of bytes that can be logged for most API buffers.
large-buffer-max Some hooked APIs permit larger buffers to be logged. To change the limit for this, set this to an integer of your choice.
norefer Disables use of a fake referrer when performing URL analyses
file When using the zip or rar package, set the name of the file to execute
password When using the zip or rar package, set the password to use for extraction. Also used when analyzing password-protected Office documents.
function When using the dll package, set the name of the exported function to execute
loader When using the dll package, set the name of the process loading the DLL (defaults to rundll32.exe).
arguments When using the dll, exe, or python packages, set the arguments to be passed to the executable or exported function.
appdata When using the exe package, set to 1 to run the executable out of the Application Data path instead of the Temp directory.
startbrowser Setting this option to 1 will launch a browser 30 seconds into the analysis (useful for some banking trojans).
browserdelay Sets the number of seconds to wait before starting the browser with the startbrowser option. Defaults to 30 seconds.
url When used with the startbrowser option, this will determine the URL the started browser will access.
debug Set to 1 to enable reporting of critical exceptions occurring during analysis, set to 2 to enable reporting of all exceptions.
disable_hook_content Set to 1 to remove functionality of all hooks except those critical for monitoring other processes. Set to 2 to apply to all hooks.
hook-type Valid for 32-bit analyses only. Specifies the hook type to use: direct, indirect, or safe. Safe attempts a Detours-style hook.
serial Spoof the serial of the system volume as the provided hex value
exclude-apis Exclude the colon-separated list of APIs from being hooked
exclude-dlls Exclude the colon-separated list of DLLs from being hooked
dump-on-api Dump the calling module when a function from the colon-separated list of APIs is used (requires DumpOnAPI package)
depth Sets the depth an instruction trace will step into (defaults to 0, requires Trace package)
count Sets the number of instructions in a trace (defaults to 128, requires Trace package)
referrer Specify the referrer to be used for URL tasks, overriding the default Google referrer