d0cde86d...45b9 | Environment
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Riskware, Wiper, Trojan, Ransomware

d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9 (SHA256)

tcpsov.exe

Windows Exe (x86-32)

Created at 2019-02-10 19:09:00

...

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "5 minutes" to "10 seconds" to reveal dormant functionality.

Virtual Machine Information

Name win10_64_th1
Description -
Architecture x86 64-bit
Operating System Windows 10 Threshold 1
Kernel Version 10.0.10240.16384 (c68ee22f-dcf6-4778-95c5-4a862be16567)
Network Scheme Name def
Network Config Name def

System Information

Computer Name LHNIWSJ
User Domain LHNIWSJ
User Name CIiHmnxMn6Ps
User Profile C:\Users\CIiHmnxMn6Ps
Temp Directory C:\Users\CIIHMN~1\AppData\Local\Temp
System Root C:\Windows
Sample Directory C:\Users\CIiHmnxMn6Ps\Desktop

Software Information

Adobe Acrobat Reader Version 18.009.20050
Microsoft Office Microsoft Office
Microsoft Office Version 16.0.11126.20196
Internet Explorer Version 11.0.10240.16384
Chrome Version 58.0.3029.110
Firefox Version 53.0.3
Flash Version 25.0.0.148
Java Version 8.0.1310.11
Microsoft Project Version 16.0.11126.20196
Microsoft Visio Version 16.0.11126.20196

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (20)
»
Filename PID GUI
C:\Program Files (x86)\Common Files\recommendation-jack-accepting.exe #1808 False
C:\Program Files (x86)\Internet Explorer\hazardsbusinessacrobat.exe #2780 False
C:\Program Files (x86)\MSBuild\tank-specialties-facial.exe #1596 True
C:\Program Files (x86)\Mozilla Firefox\article_unusual.exe #1716 True
C:\Program Files (x86)\Windows Multimedia Platform\needs-radar-underground.exe #2792 False
C:\Program Files (x86)\Windows NT\ham.exe #872 False
C:\Program Files (x86)\Windows Sidebar\vbles.exe #2920 False
C:\Program Files\Common Files\baseball.exe #2220 False
C:\Program Files\Common Files\regulatory_chevy.exe #2376 False
C:\Program Files\Internet Explorer\pipes reaches processing.exe #1272 False
C:\Program Files\MSBuild\controllers_producing_shoe.exe #612 False
C:\Program Files\Uninstall Information\commandsxeroxrelationship.exe #2620 False
C:\Program Files\Uninstall Information\tokyo.exe #1976 True
C:\Program Files\Windows Media Player\beginners.exe #480 False
C:\Program Files\Windows NT\decorative_wit_bikes.exe #2648 False
C:\Program Files\Windows NT\inventory.exe #2320 False
C:\Program Files\Windows Photo Viewer\terminal recorder.exe #236 False
C:\Program Files\Windows Portable Devices\explaining.exe #436 False
C:\Program Files\Windows Sidebar\castle.exe #2244 False
C:\Program Files\WindowsPowerShell\korea.exe #2840 True
Files (270)
»
Filename
C:\Users\CIIHMN~1\AppData\Local\Temp\-mtoSNdsrEMqIKXIJgdJ.gif
C:\Users\CIIHMN~1\AppData\Local\Temp\4b3GaiCI.gif
C:\Users\CIIHMN~1\AppData\Local\Temp\5QTF58f.swf
C:\Users\CIIHMN~1\AppData\Local\Temp\5eNUlFpo95gij.swf
C:\Users\CIIHMN~1\AppData\Local\Temp\A0i7nbWiShKEtaslPXz.avi
C:\Users\CIIHMN~1\AppData\Local\Temp\ExsdAwcovRt.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\FOb VysgrS.gif
C:\Users\CIIHMN~1\AppData\Local\Temp\FTBqstMBajQ0wuJ3t.mp4
C:\Users\CIIHMN~1\AppData\Local\Temp\IlVm-hbOXgr7WpliH1IX.pptx
C:\Users\CIIHMN~1\AppData\Local\Temp\L8MwkQXThny0oJT.csv
C:\Users\CIIHMN~1\AppData\Local\Temp\LRJTpb7GLNsu8oQ_h.docx
C:\Users\CIIHMN~1\AppData\Local\Temp\RITP CSr7 _-s1U.ots
C:\Users\CIIHMN~1\AppData\Local\Temp\VidxC.ots
C:\Users\CIIHMN~1\AppData\Local\Temp\WV3LHAjjDc0ztwoYcq.gif
C:\Users\CIIHMN~1\AppData\Local\Temp\Z5WbHz9WcIhIF6i.swf
C:\Users\CIIHMN~1\AppData\Local\Temp\al 41Q_3gXphveaT.avi
C:\Users\CIIHMN~1\AppData\Local\Temp\bUvzBXL3Zs1epw.ppt
C:\Users\CIIHMN~1\AppData\Local\Temp\hwrF2C1HedVgCZ.mkv
C:\Users\CIIHMN~1\AppData\Local\Temp\ki1bwXws.mkv
C:\Users\CIIHMN~1\AppData\Local\Temp\ltklqmLKjBY4R2.swf
C:\Users\CIIHMN~1\AppData\Local\Temp\mkckMhQL5q9gr9AwJ5.avi
C:\Users\CIIHMN~1\AppData\Local\Temp\sFC- 1JscwM.wav
C:\Users\CIIHMN~1\AppData\Local\Temp\xqC4pyH.gif
C:\Users\CIIHMN~1\AppData\Local\Temp\yrExE.jpg
C:\Users\CIIHMN~1\AppData\Local\Temp\znfZi9svFq.jpg
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\13e7i.swf
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1P58qI3M SaAl5d.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\2h2iGjx76AD6ZsS9.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3gH7yk pNxGEuO-7l.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5_ajLAhhlGKHbw 77.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5aLk1t4XlW6lJC.flv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\BE25.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Bf-XZ5Xp6-qaDizC31AV.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\EYk8-3Xq2FP.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FWttYqJtFIS0TMaD.mp4
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\LA8FK4rdYF0ss.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\PRZ05l.flv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Qj2Bjfax.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RMHZM0 Gdp7MAqyjTAG.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RptNz6u ynWaZci.avi
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RxDuXNbgnOF.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\S1n9omw0.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\TEuaHd0Pxx5BwObFRqkL.mkv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\UU vx.jpg
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\XQMDIzfGXuWhuPnn.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_dGzny0R0S.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\atucMycdek.pptx
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\cqVCexHNJjCp.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\daDWwG2N2pNJ.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\eU0O.flv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\i9Mg.pps
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jjmBlL.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ki1LInLCB7Fc0o1.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\lSEN6RBl-v63sYBLZ.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\r5MZW4TW-NF0QaMyyq.docx
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\rwt33QW.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\uBxwQb0.ots
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vJlGE.pps
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xl8kXF73s GfQllvCw.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi
C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf
C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4
C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi
C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif
C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf
C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav
C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4
C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv
C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4
C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif
C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf
C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png
C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots
C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif
C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png
C:\Users\CIiHmnxMn6Ps\Documents\14kl1Er.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\4SQu-fJUP.docx
C:\Users\CIiHmnxMn6Ps\Documents\8DvWP6ns6FP
C:\Users\CIiHmnxMn6Ps\Documents\8DvWP6ns6FP\J_Vwl9NS GSlilh3.rtf
C:\Users\CIiHmnxMn6Ps\Documents\8DvWP6ns6FP\Pf5s.pptx
C:\Users\CIiHmnxMn6Ps\Documents\C9pybbi0Zh.rtf
C:\Users\CIiHmnxMn6Ps\Documents\Clmhq I4B3M.docx
C:\Users\CIiHmnxMn6Ps\Documents\DsfHkC.pptx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\8kg0IG69BiIcd.docx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx\8SX1g3.doc
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx\E75Fxx_cgr k VZyZ3C.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx\_H-reDrjkm WhRlTA.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\7F47m0EgZ8dZX.pptx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\1u VuGRqsOCB-2L.odt
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\3KCgg__pR4GeK9.doc
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\Km_upF9iIXS.doc
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\Wupb86z6Pa0.xls
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\kIdtRNQOq.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\BkxO-9zU.ppt
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\9OrodtmjDBhJuLbe.odt
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\gw68E5_1iMvW.doc
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\qBCxbe.ppt
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\rpKGMxBzvuG8S7r.csv
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\W9uW3N-W
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\W9uW3N-W\-E1aKX93RP1R2RZCF.odt
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\W9uW3N-W\AZWb4p.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\aG6cpfo6A.rtf
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\6CfoN474.ods
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\AdUtqYa.odp
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\CStc4myNkSQF.pps
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\VmgqdDjMR.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\wkW7onXNpxl.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\XBio.xls
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\aM6z6 cgA0Quu2XuDG.rtf
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\uXIZP98-W.csv
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\hi1upTBMaVjFQdLT.doc
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\iz9v0wyvDnaP.csv
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx\_5KPV Mpd_NwFiLzpDkO.odt
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx\bgvy1.rtf
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx\otlBHpdEhxfRKBbdEC.csv
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\eNh-BKvkTFiJI0o.pdf
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\ynVCH9Q0.csv
C:\Users\CIiHmnxMn6Ps\Documents\GmII-LgB.pptx
C:\Users\CIiHmnxMn6Ps\Documents\LD_X_UkqzQQjJgKTAdI1.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\Nj_573dGvcXm.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\NycH_RCh0bZXJ.pptx
C:\Users\CIiHmnxMn6Ps\Documents\QL9El1VrJ-hA.docx
C:\Users\CIiHmnxMn6Ps\Documents\S1YhzhWqOh3uV.docx
C:\Users\CIiHmnxMn6Ps\Documents\VWjfkVKtH68R-5QamicE.pptx
C:\Users\CIiHmnxMn6Ps\Documents\Z9plc4.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\ZEgz.pptx
C:\Users\CIiHmnxMn6Ps\Documents\a4Du0dq2.docx
C:\Users\CIiHmnxMn6Ps\Documents\gTwWOFPV2SYXm4cHig.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\rauGKXkey87iDzqE zZR.pptx
C:\Users\CIiHmnxMn6Ps\Documents\u_H05r1.pptx
C:\Users\CIiHmnxMn6Ps\Documents\w4npV7s7TJ2.docx
C:\Users\CIiHmnxMn6Ps\Documents\wMy1ej.csv
C:\Users\CIiHmnxMn6Ps\Music\8piPYcptlBDCxT.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\34rCIUFwM9qcN4m.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\4pDPr0y-.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\8Kr7ps-rFJPwWR.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\CQZU2kYru8C.mp3
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\Ccjm3.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\Tj3GeedAdNiy.mp3
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\rSDLAIVloPx.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\BFWrZsm78.mp3
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\D1Muduzt_rUlyemvsJQ.m4a
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\PxprpzuLI.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\U3nFCBc2rdYw4-v2.mp3
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\cu1ph3CGwErEMg7rm.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\f-LYZrjgEaU8RDknsCA.wav
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\lU bQtkzZSCqQK-4QT.mp3
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\neunX1NaE7qHKUt.mp3
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\ss5DlR_0y-.mp3
C:\Users\CIiHmnxMn6Ps\Music\Bhp0golMNrXsNA.m4a
C:\Users\CIiHmnxMn6Ps\Music\CCsUW.mp3
C:\Users\CIiHmnxMn6Ps\Music\QzF7fMmnPAX1UspXI2OT.wav
C:\Users\CIiHmnxMn6Ps\Music\XjUK7.mp3
C:\Users\CIiHmnxMn6Ps\Music\lorBd.m4a
C:\Users\CIiHmnxMn6Ps\Music\mLyzUln t O.mp3
C:\Users\CIiHmnxMn6Ps\Music\peQ0.mp3
C:\Users\CIiHmnxMn6Ps\Music\sBwshSMWZl1CCOl938ow.mp3
C:\Users\CIiHmnxMn6Ps\Pictures\-pIL7
C:\Users\CIiHmnxMn6Ps\Pictures\Bujeen.gif
C:\Users\CIiHmnxMn6Ps\Pictures\PEn2SpL9GX4B3.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\a92ON6tXS3b-0BytKd7q.png
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\24b2j.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Dy7IEBNO7xRwaN9xgSY.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\F-nPn 203du.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Ie-qLVk1rYuhk5L.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Ja72_h.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\UKmJhYHC35r.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Y9M41tsbUrdxwHTVlDAD.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\a0PIkysSn7Xp1_ SzIlF.png
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\wJdfMc.gif
C:\Users\CIiHmnxMn6Ps\Pictures\cXmt
C:\Users\CIiHmnxMn6Ps\Pictures\cXmt\9Te_uhKRq.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\J3feoRb5vhUg0kkWPDP.png
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD\QECD50592wNNZ.gif
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD\sJX8t_3
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD\sJX8t_3\jqEpOoeS3K9JLr8.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\MSu_I.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\LmZgbb11VSFvs5ATNBg.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\OE78o.gif
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\bnoXBWIDrdBzRCYnLOh5.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\lHUNW863.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\sa6ykd8hCmyAGoPEG.gif
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\sr_viouXB4hTq2Xh.gif
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\SNmk0R2dk6.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\mRdRtl9oi58nOnhgZH.gif
C:\Users\CIiHmnxMn6Ps\Pictures\ie1buAANsi7
C:\Users\CIiHmnxMn6Ps\Pictures\ie1buAANsi7\BpV_YB3Y_d20EsN6BsJ.png
C:\Users\CIiHmnxMn6Ps\Videos\27bKO.swf
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\5kSoICo6Wa.flv
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\7xhQ.mp4
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\ATGAksmDVhJ-I.mp4
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR\EFB9kLXhIY z6QimjGU.avi
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR\Jhmo0ps7j.flv
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR\LbRqYSwSmec.mp4
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\L48N.avi
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\iq5vdAa6kn4ni.avi
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\jyZGwzJW.swf
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\- xXGXnYoD3B4nSv55.mp4
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\DKLkABrmCFH.mp4
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\TOW8VxN7d4qg-u_.swf
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\gzaO96SZyxla E2JoW2.swf
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\ynOni _soZgvyxoweNI.swf
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\WaX-o
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\WaX-o\A6KlRAIHTbS.mp4
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\WaX-o\b4l01u.mkv
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\ZD1qInA.avi
C:\Users\CIiHmnxMn6Ps\Videos\5vNb5U7n-3jWILg
C:\Users\CIiHmnxMn6Ps\Videos\8b0wWXFjaRhP8zonR4v.swf
C:\Users\CIiHmnxMn6Ps\Videos\KIB8.avi
C:\Users\CIiHmnxMn6Ps\Videos\tXOm7d8FMl.mkv
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\0zgYnmkP7veXN.swf
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\X259pgWC6QIqfdB1S2G.swf
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\nSWv fNLEiiwv-WQJ5.mp4
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\wYOJ.avi
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image