a867deb1...fb02 | Environment
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Wiper, Ransomware

a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02 (SHA256)

SCN0tification.exe

Windows Exe (x86-32)

Created at 2019-03-02 17:30:00

...

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "12 hours, 46 minutes" to "6 minutes, 30 seconds" to reveal dormant functionality.

Virtual Machine Information

Name win10_64_th1
Description -
Architecture x86 64-bit
Operating System Windows 10 Threshold 1
Kernel Version 10.0.10240.16384 (c68ee22f-dcf6-4778-95c5-4a862be16567)
Network Scheme Name def
Network Config Name def

System Information

Computer Name LHNIWSJ
User Domain LHNIWSJ
User Name CIiHmnxMn6Ps
User Profile C:\Users\CIiHmnxMn6Ps
Temp Directory C:\Users\CIIHMN~1\AppData\Local\Temp
System Root C:\Windows
Sample Directory C:\Users\CIiHmnxMn6Ps\Desktop

Software Information

Adobe Acrobat Reader Version 18.009.20050
Microsoft Office Microsoft Office
Microsoft Office Version 16.0.11126.20196
Internet Explorer Version 11.0.10240.16384
Chrome Version 58.0.3029.110
Firefox Version 53.0.3
Flash Version 25.0.0.148
Java Version 8.0.1310.11
Microsoft Project Version 16.0.11126.20196
Microsoft Visio Version 16.0.11126.20196

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (21)
»
Filename PID GUI
C:\Program Files (x86)\Internet Explorer\cindy.exe #2648 False
C:\Program Files (x86)\Internet Explorer\commandsxeroxrelationship.exe #2376 False
C:\Program Files (x86)\Microsoft.NET\nice cu.exe #2768 False
C:\Program Files (x86)\Mozilla Firefox\j_variables_changes.exe #296 False
C:\Program Files (x86)\Reference Assemblies\actual.exe #2252 False
C:\Program Files (x86)\Windows Mail\potter larry.exe #2688 False
C:\Program Files (x86)\Windows Mail\reaches processing culture.exe #2760 False
C:\Program Files (x86)\Windows Sidebar\thats.exe #1816 False
C:\Program Files\Common Files\isp.exe #632 False
C:\Program Files\Common Files\pacific.exe #2616 True
C:\Program Files\Common Files\video_reviewing.exe #2620 False
C:\Program Files\Internet Explorer\fantasy.exe #240 False
C:\Program Files\Microsoft Office 15\accepting.exe #500 False
C:\Program Files\Microsoft Office 15\bikes goods whilst.exe #2904 False
C:\Program Files\Uninstall Information\authorized.exe #752 False
C:\Program Files\Uninstall Information\contents what certificate.exe #2840 False
C:\Program Files\Uninstall Information\shame.exe #2160 False
C:\Program Files\Windows Mail\cowboy.exe #1284 False
C:\Program Files\Windows Multimedia Platform\printable_fountain_korea.exe #2080 False
C:\Program Files\Windows Multimedia Platform\unusual.exe #740 True
C:\Program Files\Windows Sidebar\phantom.exe #132 True
Files (270)
»
Filename
C:\Users\CIIHMN~1\AppData\Local\Temp\0sm2PqYGoBC.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\3vUAl4v.mp4
C:\Users\CIIHMN~1\AppData\Local\Temp\5L-L- jLm3puQbqOu.xls
C:\Users\CIIHMN~1\AppData\Local\Temp\9UY3Zwgh5.flv
C:\Users\CIIHMN~1\AppData\Local\Temp\Bw0E ds-TLScPG.csv
C:\Users\CIIHMN~1\AppData\Local\Temp\E6ctkrKZC6cEs.csv
C:\Users\CIIHMN~1\AppData\Local\Temp\E899k.ppt
C:\Users\CIIHMN~1\AppData\Local\Temp\Ed05kzh.avi
C:\Users\CIIHMN~1\AppData\Local\Temp\JAA3OD5.mkv
C:\Users\CIIHMN~1\AppData\Local\Temp\KmhTQJYrzhXitdV78.m4a
C:\Users\CIIHMN~1\AppData\Local\Temp\MLyAI.mp4
C:\Users\CIIHMN~1\AppData\Local\Temp\R8O9e0R0NQn k7PMC.bmp
C:\Users\CIIHMN~1\AppData\Local\Temp\SPE4ZspWv.m4a
C:\Users\CIIHMN~1\AppData\Local\Temp\ZxUPIudHrRgLcbx.avi
C:\Users\CIIHMN~1\AppData\Local\Temp\ccvMFlKlfrj24RbfixkT.wav
C:\Users\CIIHMN~1\AppData\Local\Temp\eS6vdPAe.m4a
C:\Users\CIIHMN~1\AppData\Local\Temp\iRtsdkzGAD.swf
C:\Users\CIIHMN~1\AppData\Local\Temp\ilQgNYAjiMklEfb.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\nGFA6um9RYgrotMX7n3.jpg
C:\Users\CIIHMN~1\AppData\Local\Temp\oWfEcfC0l_09NZ hBEo.docx
C:\Users\CIIHMN~1\AppData\Local\Temp\oWlsbPHVzwyAUreCh.avi
C:\Users\CIIHMN~1\AppData\Local\Temp\qI7nKUP6lRbb6b.swf
C:\Users\CIIHMN~1\AppData\Local\Temp\rkhxAKK4Ol4IyjS.gif
C:\Users\CIIHMN~1\AppData\Local\Temp\whDeOYwKvB9pYQxAc.jpg
C:\Users\CIIHMN~1\AppData\Local\Temp\z-13vVQ9rT-UTRl0o.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\0PoBSIxH0YpucZ.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1lAFvzV4s.odt
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3EEs9PX5umwztrfT1-.mkv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\44o5oQt4naJgkr.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5UWKf2AZA-PyXneO.pps
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5by rfYq.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8y4X.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9rOl8e.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Csrjzy.avi
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DVHrZ7utvh uKOX.jpg
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Dh163eMUkixaU.mkv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\EvKs4Lb.xls
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Evssa7Xwva0Jyi.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FuIor0brEJhxaWR.xlsx
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\GRJT1R_yC.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\GqwE_7Z4.png
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\KFnvTnu3jzEAhmZ.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\N0EIP3S-aIBd.ods
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\PfPr0xWcW73OD5HqU.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\QqVYy2aZ32kS3_7Qv.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\T-ZVO2cm3AwDvpyQqR5.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\UHSRpa2DzVeCf-2kMVs.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\a5fARpelBoqt9wNN.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\c2WkN.docx
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\cdjUivP2bW7E.ots
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\dEmqdtI7v.flv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ixFmiZ6sg_vp.rtf
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\kQMsV1d3JCA9g44O.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\nZdGZ.ots
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\oKVfdSLKco2836l2w9ps.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\pVq-HZyP_sfqlxNE4uu.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\sE7q0-KMNEw6EiD2-.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vQK2IRy8U eunsG.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xQJnnGN2Vfre.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\-NlSo.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\-aXVf.flv
C:\Users\CIiHmnxMn6Ps\Desktop\2SXCpVLNs73BQPAtgxC.png
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3IveDjbz33f.mkv
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\3eETFbJdu0.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\8P2mSya3098KVulU.wav
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\AK8M AL1ySTdgK.odt
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\LzUKcb-uGVeX.png
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\iFWD4toa.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\37Pif51-yjT\kDpdV 3nnSnJmGqPO.ppt
C:\Users\CIiHmnxMn6Ps\Desktop\45dQ123.wav
C:\Users\CIiHmnxMn6Ps\Desktop\Bu5bp9.avi
C:\Users\CIiHmnxMn6Ps\Desktop\O4rsCOfAWVNZ.mp4
C:\Users\CIiHmnxMn6Ps\Desktop\OALKMuc2ka4.gif
C:\Users\CIiHmnxMn6Ps\Desktop\P9oN_mVJ_5GZ wuO.avi
C:\Users\CIiHmnxMn6Ps\Desktop\ROHZJx8ipU.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\VX9FUGeY-MvLyFL6.gif
C:\Users\CIiHmnxMn6Ps\Desktop\Y_LI3 4-qP.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\aV64x7o3lA2K.wav
C:\Users\CIiHmnxMn6Ps\Desktop\ape_Je.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\DqXOsfvU6Y tHX.wav
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\IR-tjQBZzd_N5h-S0 pI.doc
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\MiEnBI8.docx
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\_7SiEN5ix Oq_lUu N.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\1bwm2R-ai\iJYJHrgQ2a2pzMtZL.swf
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\0-Tv sYMFqGkma 6x.wav
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\Na0N0W_tVH__RG.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\85KqQFXPbTBEpm1Ws\hGqTnSOKZQ5a1.ods
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\FnTKrRERf_0VWyksIzp.xls
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\Y_62XF6X1FjEo5B7P.avi
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\22-J61Dy1gKz.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\fkya9Y5PGZm9_q\Ins8Esh4IdpaiiYPl TD.avi
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\mJbzYvV0BW4OFQ1.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\ccqskCJ2SS\nmKbd_Etp705mK8.odt
C:\Users\CIiHmnxMn6Ps\Desktop\dBpSfcucLn3NuQ6je7.rtf
C:\Users\CIiHmnxMn6Ps\Desktop\dizklXpXe.ppt
C:\Users\CIiHmnxMn6Ps\Desktop\lGBL1f9.swf
C:\Users\CIiHmnxMn6Ps\Desktop\nYkivMTIATrvxLZ.xls
C:\Users\CIiHmnxMn6Ps\Desktop\rvq7ekaaX.gif
C:\Users\CIiHmnxMn6Ps\Desktop\s5DMlEpMOzEY.pdf
C:\Users\CIiHmnxMn6Ps\Desktop\t39geveg0wynNP.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\uQNDwbW1Y.avi
C:\Users\CIiHmnxMn6Ps\Desktop\wh 8KrD6eNSHE.gif
C:\Users\CIiHmnxMn6Ps\Desktop\xj7qoX0- 7l3FO.mkv
C:\Users\CIiHmnxMn6Ps\Desktop\z29LckBw5RcM_XD.png
C:\Users\CIiHmnxMn6Ps\Desktop\zsdQJc9p9rp.png
C:\Users\CIiHmnxMn6Ps\Documents\1u1PtMsi_p5I6Kp0gVZ.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\4CDCeVLoOGDNNc.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\5EUw6X.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\5eq4aL0vBSUL.pps
C:\Users\CIiHmnxMn6Ps\Documents\FnCzF1A7H gxenH83.pptx
C:\Users\CIiHmnxMn6Ps\Documents\JF6Z1xvDFv.docx
C:\Users\CIiHmnxMn6Ps\Documents\MI47.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\SATDQcfMYoPlh.docx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\uhL6PZJxrZwaAeTB.ods
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\-PZcxu.pps
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\51gZ9cs6QyQwB.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\FMVnxBVv7u9Rp.docx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\2pWzntbD\ttYeA5K8BN5b.ppt
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\UmcQX7d.pptx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\XJ2OD9lQq0BG.docx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\r873fj.xls
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\7Hk2Lc8bYx_mxaoZre\s9_oB4RJJAVSDjPCS.pdf
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\GAgDtV.ods
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\-3ostnyb\yhA0tWH2QIX.odt
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\LJ2-ZSo63V_7d.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\1gqxJ7phl\pdKaXJhzd7zYz7o.doc
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\3kj8Y-EDPTFO.pptx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\5NEaCJn_lqI_2wf_A.pdf
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\NHki1vMmaXoWuhnR.pdf
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\gGPxR1SI06PikWMCd.rtf
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\4cjd3SaCmW1\tyDDeYuppbUilesSL.odt
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\3B2V8p-DhIekN7FYAT.docx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\5qiwP0Jfq.pps
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\HpvWb5EHtTvn89.pps
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\Q0WDNI_cEJvL.pdf
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\fsxQuEAvOd0El-v.pps
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\gl54xs.odt
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\h8IhXzO4v.csv
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\oGyow62Ehp.pdf
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\Qq3R.ots
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\iclup5FUSoIoGUEpJ 8n.pps
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\rMpN_ZRY5SqnHAJ8aGld\k4LJ2WYGO9QfwUDPoT.doc
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\tpkoPGhxV.xls
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\isZLUU\vv1t.doc
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\0KK10L8Yj9PSdD5_rlI8.pptx
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\6w48s.rtf
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\B-2cmW.doc
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\CQjd3NSx.ppt
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\DYnSH7i.xls
C:\Users\CIiHmnxMn6Ps\Documents\WZsO9vKmM1PXfg\us_5U4ni7qwInOUE\sNkHGs\mR4SZZ7.pptx
C:\Users\CIiHmnxMn6Ps\Documents\ZmbKh2wUNBqMsH-.docx
C:\Users\CIiHmnxMn6Ps\Documents\gCLjM xynMaWR.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\hJZX8AFOtoTuk B35pJ_.pdf
C:\Users\CIiHmnxMn6Ps\Documents\hfoKW.pptx
C:\Users\CIiHmnxMn6Ps\Documents\mlv6Gzv7Da-BgmdC.docx
C:\Users\CIiHmnxMn6Ps\Documents\nP0r3x5d.ods
C:\Users\CIiHmnxMn6Ps\Documents\o1_fy8.pptx
C:\Users\CIiHmnxMn6Ps\Documents\obHPe.pptx
C:\Users\CIiHmnxMn6Ps\Documents\u6hnCYVE2vuu.docx
C:\Users\CIiHmnxMn6Ps\Documents\ziNabL4eBQn3JC_djnr.pptx
C:\Users\CIiHmnxMn6Ps\Music\2G6M.mp3
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\2HvoIrFtByws.mp3
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\69_UAHNRs.mp3
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Dg7 CrsqU k7Xp.mp3
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\GsSWFcQiPn.wav
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\LG0LJ99M.mp3
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\Tvn8aqPC_U.wav
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\dCyPtvG.wav
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\gRZdqIY3h.mp3
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\p6xCw Vob.mp3
C:\Users\CIiHmnxMn6Ps\Music\GO5j 80\t41qgP8Zl.wav
C:\Users\CIiHmnxMn6Ps\Music\I8Dv-9gTrMuD.mp3
C:\Users\CIiHmnxMn6Ps\Music\N0rL.wav
C:\Users\CIiHmnxMn6Ps\Music\Pf3R-b3DBtl.wav
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\NRNil.wav
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\aR-iIw.m4a
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\bWUX20g7Mm7g1y.wav
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\g8L7418FmZslF.wav
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\lqlP4y.wav
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\rKQbOo.m4a
C:\Users\CIiHmnxMn6Ps\Music\ZZaKb_aT-x EADqBsw\zdZ3oJ-bfmJu.wav
C:\Users\CIiHmnxMn6Ps\Music\eEmxkUZ3.wav
C:\Users\CIiHmnxMn6Ps\Music\p6UEXQwLP.mp3
C:\Users\CIiHmnxMn6Ps\Music\vEcRh3pLVRcZ1O.mp3
C:\Users\CIiHmnxMn6Ps\Music\z8Pr_v.mp3
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\4LAv.png
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\-yOADLMtpkF
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\jA0o4Ao7ru.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\dDTdaFbzRTbH.png
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\uOf1gCg-syx.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\E6JXhV-d_ UCg59VKS\xBTg.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\MsxtzGW tpKDJN.gif
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\TqgqXxG.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\jf2gmUDSNpxqc ZNVVv.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\lAHCz7usAd.gif
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\-Z88RWVEKHn2YHbC6YS.gif
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\50YQIo4i.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\6ORqLC9av8hKhylQ04z2.png
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\0eBemC7.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\7Luf9iKqys 6\lMwuMumsTcOMWQg.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\J7dCVSJUmB\N6 e0qhUxBM.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\h72I_b.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\itHSyuXpEG8bbygGV.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\72AEjtrdw7I\xDtCMA3q\lYPIT_a_zAinFFHfUDV.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\QVr-mzOnFHsqrr\q0YpRzhHSmV\Z-AP6tzBW HexwllgoRb.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\Qm paxELf.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\aClNMcka4 SH9Md3Hwo.png
C:\Users\CIiHmnxMn6Ps\Pictures\7B iYIRm\wGSFbii.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\MgyGAvvq5w6fl7AR1Hfa.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM
C:\Users\CIiHmnxMn6Ps\Pictures\bLdID5XJzq jCM\IwWqYwDX1-Oo2.gif
C:\Users\CIiHmnxMn6Ps\Pictures\qp-3yc7D3FrGiW.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\vxT7Wz-UZ XFfNDp.png
C:\Users\CIiHmnxMn6Ps\Videos\Up-xCZd9p 2yrWN.mp4
C:\Users\CIiHmnxMn6Ps\Videos\VYNmKqyqyi.mkv
C:\Users\CIiHmnxMn6Ps\Videos\Xj74 9 m.flv
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\4ioWuMxhZ Ndf1N_b.flv
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\_F8m3hu10142ds4cz1.avi
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\0_psbc9.avi
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\3m7QHv7T5mGuFh2A31Q.avi
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\4xODVA0z5L5w0l.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\hpUT\H9o_U92tz2Ho9-mh.swf
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\oJoLhaSYb.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pB rGU0A_4l5KRvtZ sr.mp4
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\34Z4dfhq5fY_tfB.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\bvv97LkO.swf
C:\Users\CIiHmnxMn6Ps\Videos\XtvCrj2M0wzyx7ebEjj\pQzyM\w w7R5kGwiD8.mkv
C:\Users\CIiHmnxMn6Ps\Videos\_eEl
C:\Users\CIiHmnxMn6Ps\Videos\_eEl\1HSy82Y7UuTj0Jd69.mp4
C:\Users\CIiHmnxMn6Ps\Videos\_eEl\Q07hPTbYaA2sSmp7JYW8.swf
C:\Users\CIiHmnxMn6Ps\Videos\_eEl\QGtWvWHnjohYH0 tv.swf
C:\Users\CIiHmnxMn6Ps\Videos\_eEl\eztfYAzpK0.mkv
C:\Users\CIiHmnxMn6Ps\Videos\bVHx1G7LG6.swf
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\33G0h-QVWGTGNhCEha.mp4
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\S20n9CABG0uo.mp4
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\62uD.avi
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\Eowo0nLnhzDtXx7wGkmW.mp4
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp
C:\Users\CIiHmnxMn6Ps\Videos\wNN lOPK\ugEH\VAlp\gbg6IyO.avi
C:\Users\CIiHmnxMn6Ps\Videos\zDzpwp-28.avi
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image