b40b1477...f3b4 | Environment
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Trojan

Virtual Machine Information

Name win7_64_sp1
Description -
Architecture x86 64-bit
Operating System Windows 7
Kernel Version 6.1.7601.17514 (3844dbb9-2017-4967-be7a-a4a2c20430fa)
Network Scheme Name Local Gateway
Network Config Name Local Gateway

Analyzer Information

Analyzer Version 3.0.2
Dynamic Engine Version 3.0.2 / 2019-05-15 18:28 (UTC+2)
Static Engine Version 1.1.1 / 2019-05-15 18:29 (UTC+2)
Local AV Version AVCORE v2.1 Linux/x86_64 11.0.1.18 (Aug 9, 2017)
Local AV Database Update Release Date 2019-05-29 00:14 (UTC+2)
VTI Ruleset Version 3.3
YARA Built-in Ruleset Version 1.2
Analysis Report Layout Version 4

System Information

Computer Name XDUWTFONO
User Domain XDUWTFONO
User Name 5p5NrGJn0jS HALPmcxz
User Profile C:\Users\5p5NrGJn0jS HALPmcxz
Temp Directory C:\Users\5P5NRG~1\AppData\Local\Temp
System Root C:\Windows
Sample Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop

Software Information

Adobe Acrobat Reader Version 10.0.0
Internet Explorer Version 8.0.7601.17514
Chrome Version 58.0.3029.110
Firefox Version 25.0
Flash Version 11.2.202.233
Java Version 7.0.450.18
.NET Version 4.6.00081
Powershell Version 2.0
Microsoft Office 2010
Microsoft Office Version 14.0.4762.1000
Microsoft Project Version 14.0.6023.1000
Microsoft Visio Version 14.0.6022.1000

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (25)
»
Filename PID GUI
C:\Program Files (x86)\Common Files\ant.exe #804 False
C:\Program Files (x86)\Common Files\envelope.exe #928 False
C:\Program Files (x86)\Google\measuremaineladen.exe #284 False
C:\Program Files (x86)\Google\submissionrepresentativestrouble.exe #812 False
C:\Program Files (x86)\MSBuild\file.exe #276 False
C:\Program Files (x86)\MSBuild\ide ted entire.exe #1960 False
C:\Program Files (x86)\Microsoft Analysis Services\jonathan appropriations.exe #2024 True
C:\Program Files (x86)\Microsoft Office\philosophy_catering.exe #1488 False
C:\Program Files (x86)\Reference Assemblies\devoted.exe #712 False
C:\Program Files (x86)\Uninstall Information\graduates.exe #1304 True
C:\Program Files (x86)\Windows Defender\apparel together brass.exe #1852 False
C:\Program Files (x86)\Windows Defender\pattern weblog.exe #944 False
C:\Program Files (x86)\Windows Mail\guaranteed tumor.exe #388 False
C:\Program Files (x86)\Windows Mail\homes-golf.exe #1952 False
C:\Program Files (x86)\Windows Media Player\focus gone.exe #792 False
C:\Program Files\Common Files\developers quality.exe #1940 False
C:\Program Files\Internet Explorer\rotary-mining-judges.exe #1908 False
C:\Program Files\MSBuild\vessel get.exe #1716 False
C:\Program Files\Microsoft Synchronization Services\cnn.exe #2052 True
C:\Program Files\Microsoft Synchronization Services\enquiryreads.exe #1724 False
C:\Program Files\Uninstall Information\stan adopted.exe #1844 False
C:\Program Files\Windows Defender\kissunlesszum.exe #1684 True
C:\Program Files\Windows Journal\journalistscharacters.exe #516 False
C:\Program Files\Windows Mail\merchandise_notification.exe #1972 False
C:\Program Files\Windows Media Player\graph strange.exe #1956 True
Files (282)
»
Filename
C:\Users\5P5NRG~1\AppData\Local\Temp\0cItIdDxD_.flv
C:\Users\5P5NRG~1\AppData\Local\Temp\3-5BkLHXeSOiw.avi
C:\Users\5P5NRG~1\AppData\Local\Temp\3iGF401NXUU.jpg
C:\Users\5P5NRG~1\AppData\Local\Temp\4QiW9FOn4Us.avi
C:\Users\5P5NRG~1\AppData\Local\Temp\51iEd1iO-glNbFn-6x8z.xlsx
C:\Users\5P5NRG~1\AppData\Local\Temp\6FI3.wav
C:\Users\5P5NRG~1\AppData\Local\Temp\73r-.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\7vTTj8DsUes_owg4ZHlJ.swf
C:\Users\5P5NRG~1\AppData\Local\Temp\80Z5d-X0EdojTocJ.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\BV68k7P.wav
C:\Users\5P5NRG~1\AppData\Local\Temp\D8biWN1rtx9u.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\FX0zNVkdngh.xlsx
C:\Users\5P5NRG~1\AppData\Local\Temp\H0evx2Z7bVZPjlE.m4a
C:\Users\5P5NRG~1\AppData\Local\Temp\I_7fC.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\IznB24bLxf.pptx
C:\Users\5P5NRG~1\AppData\Local\Temp\KfrD.doc
C:\Users\5P5NRG~1\AppData\Local\Temp\LXsgRTbCoe8Hv.xls
C:\Users\5P5NRG~1\AppData\Local\Temp\Mk-6b4-zrCC-z.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\MlVIlXjEtoVc.m4a
C:\Users\5P5NRG~1\AppData\Local\Temp\O_E6NghlSLcRSGa.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\QBjz9C.m4a
C:\Users\5P5NRG~1\AppData\Local\Temp\RzyoiEu.m4a
C:\Users\5P5NRG~1\AppData\Local\Temp\THI715vkoCKZ.swf
C:\Users\5P5NRG~1\AppData\Local\Temp\YyL6Xcm5mw.flv
C:\Users\5P5NRG~1\AppData\Local\Temp\eIM36.bmp
C:\Users\5P5NRG~1\AppData\Local\Temp\fXYBrLaufj.mp3
C:\Users\5P5NRG~1\AppData\Local\Temp\hdT0sv2.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\m2NBPUBKO2d9G.rtf
C:\Users\5P5NRG~1\AppData\Local\Temp\mQ_4XREIqa0lpLMst.gif
C:\Users\5P5NRG~1\AppData\Local\Temp\mdvnAneyO zerW6h.m4a
C:\Users\5P5NRG~1\AppData\Local\Temp\oLTLpPF.mkv
C:\Users\5P5NRG~1\AppData\Local\Temp\pY6v.wav
C:\Users\5P5NRG~1\AppData\Local\Temp\rdVE.jpg
C:\Users\5P5NRG~1\AppData\Local\Temp\sFA_2KBl-9rJCAf.jpg
C:\Users\5P5NRG~1\AppData\Local\Temp\x3sRGwJiMn_4F2.xlsx
C:\Users\5P5NRG~1\AppData\Local\Temp\xltOBUEO7Jn90P.gif
C:\Users\5P5NRG~1\AppData\Local\Temp\yWFWqcuyj.mp4
C:\Users\5P5NRG~1\AppData\Local\Temp\zAkEloW6P1HTUMi6AT.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\1yh3DLrxaoFJkIQfrfNo.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\2ssF2Efd3cGzIw6AcA-E.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\2xz1RO6.png
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\6lbsOUBd.swf
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\7OBKoDTgvlp3tNn0tUY.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\7gs-a_h.wav
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\8Vo7TX4NxGV_6yZ.swf
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\8k7dRZxZJLyop.avi
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Bf4FmnCtro.wav
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Izy_8LbP5 SkI4U3.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Nk9g06hAl9R48dJcjU5.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\WWGy.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\YYWcuPfEawmj8GO.png
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ZP24jnHyKvlBUmW.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\bY6f-qu.wav
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\hFNkB0w_nSxhk5.flv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h_lZoJ7SDSJLS2DlUjM.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\m7irgTv9txpbXOe-J9.gif
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\mXe4uB2VimRTmr -fJX.avi
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\nMykuRF2L2Roi-yd.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\oEryJ8.wav
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qmwG_lPv8Sy-.pps
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\rSnuPF73OG.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\uK1t24hTTDPN.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ucQC3UgDllCMNWk55.png
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7MlTl.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4AyxQ4Asnv8YCh
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4AyxQ4Asnv8YCh\4wRH4y1wF.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4AyxQ4Asnv8YCh\8Q7_E00Nn.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4AyxQ4Asnv8YCh\92SqBSmzqyu5f4m9HJ.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4AyxQ4Asnv8YCh\B3iGIse5.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4AyxQ4Asnv8YCh\BtLjkKNhVSW9.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4AyxQ4Asnv8YCh\vO-Q3wEvw19QXQj7o7.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CA2vvd5RszgC9X9.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CoidRAim2UI_xVgAzMQ.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\D3RIeSFsRjUJvmfO5k.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DYQA1cT0i
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DYQA1cT0i\-YiUym98CefOJnM7.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DYQA1cT0i\DRJ3YoZi.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DYQA1cT0i\K1hFVV.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DYQA1cT0i\QP_2bertGWlxW38s8V.png
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DYQA1cT0i\XP402o_HaB92WT.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FLFkxvsrE0ugCoA.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HK3Ky7fNG.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JGH5Uc81F33TIvk2xq7X.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KXl_L.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NBaV17yu.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VlHM9.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YcGJ.png
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bWpmyCC q.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\9otaVVoUH.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\vY9ck
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\vY9ck\AlAIXJw4PMJJN.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\vY9ck\DS qK5U6GlrByDnMfOb.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\vY9ck\KtPvOHey12.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\vY9ck\bNUus4jLLe7VsixX.png
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\vY9ck\h783w64_BO.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ddcl7yemRV_VB3GM\zBZN82.pps
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fJ83XvPR0nwFa.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hB3MDBlBlL-Ov.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ljmqw0H.png
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pcjIduG.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\r_ 2S5.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rabV7rsh0FDfgGzMWj.png
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\sD9L7zck.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\t6nsBM3_uzcSRquG2MCL.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\tSQTtNHXQNxo7wHv.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\uTaWwg96v2b.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ujUQ.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xd6zGY7x.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xuzPgEt.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\y6gC.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\z7jq2z5yRWxxEp.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\zicvfIt.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\-hkVVm33ODe7RTkesfMv.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1FaNtdFXe xur0j_.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\6oHhq.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7QR0REHd.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Av SAbfSJsN9-vQ8Vg.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\CqrIgC2P.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\CvKJX9S21VjflQa-Rn.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\IWRuXBVe3ttD8rhgaR
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\IWRuXBVe3ttD8rhgaR\Ey1g96H-CPkCk.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\IWRuXBVe3ttD8rhgaR\I2ZaM9BOVZniry_0NE.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\IWRuXBVe3ttD8rhgaR\fDWT w.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\IWRuXBVe3ttD8rhgaR\y_2Eu.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\vQVB9yQweK4.ppt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GO 84MtytL61\zblm.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\J4pCTPHjd.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KVXES4u9GtRVvN.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V\1vcsIK8F.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V\CiYt N3W_yd 7XZ3h.ots
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V\E5Awz_7kZCLhZA4.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V\HCFaLwaP.csv
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V\eZVyPGcST5nJ4a.ots
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V\jeMGkL9dvCBmjv.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LTHzG3-Kf-26ZbkfXo4V\p-ty_zL-ZX5EPKAddY.ots
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\LnQb_tEMZgt.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TPDJfN4e.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Z9LBSWevcJoYDWCs.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\adKiuOii.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\bKv99JA0pV5y2M
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\bKv99JA0pV5y2M\9xN2NL9trDzKtQJ.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\bKv99JA0pV5y2M\iME 3oprrr6sreGDPPv.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\-ChzT1z0txh0o.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\56ewMXSHO14P_QUUG
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\56ewMXSHO14P_QUUG\p02l4FwhV2xY72Iy-V.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\AT6XMC0EQeVi1A2mV.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\ErUxVpAk.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\GXYlivx9x1D1V
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\GXYlivx9x1D1V\er_k7TAeR.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\GXYlivx9x1D1V\gOTLqx8qPC7S.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\GXYlivx9x1D1V\zoueEPJPdu-fo.rtf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\JDOpTnfMpMd
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\JDOpTnfMpMd\FrO8dkiWys.ods
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\JDOpTnfMpMd\HkYDFSDka.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\JDOpTnfMpMd\s4_NUmQtaLicuUnjH8-.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\LynBYjw0.pdf
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\ApvND4cEO.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\NcDSSHx.odt
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\Z_0Nbr8swlIsIK9J-R8.doc
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\eO1NZxiBK
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\eO1NZxiBK\9_h25A2VMsSerQL.doc
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\eO1NZxiBK\G khWPbPieMrvALSCmrn.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\eO1NZxiBK\VFWE0GJ.pps
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\c-3k54cem74qjooD\WX6tX_z9K5sz\o8DR8mos0 LjoVaIgGQy.xls
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\f3CKNH1mg2L_.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\i9 v.docx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kcKYV3.pptx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qD-J07tGneFsvl.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qWMcA.xlsx
C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\JD-tsrvF2.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\KfS6I9.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\O2aPlZsulS.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\QiM jAC.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\UYjfw0CDsB AodTHHd.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\WP4KrGPfe.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\4_U9Ib4M.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\8uTN.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\B7VBhHSAUzHh2b.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\JN4A4o3Q9kS.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\dQRxy-7flS.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\fsulKw.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\gcAd.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\kZ_ci1.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Music\Z-yKq14SjTyCv.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\oVcBcPe8aoMcbmJ6L.wav
C:\Users\5p5NrGJn0jS HALPmcxz\Music\qPi-26_R5Y.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\t92T rcs.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\x hNiw1Ois TfWIABIB.mp3
C:\Users\5p5NrGJn0jS HALPmcxz\Music\xqfbr92zFKybE.m4a
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\BmQENFxEA0Ca
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image