fb136c83...d3f4 | Environment
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Downloader, Ransomware

fb136c8360d1a5ab80f61109c55c5a788aa1d8796d1e75aca8c1a762b598d3f4 (SHA256)

sstojx.exe

Windows Exe (x86-32)

Created at 2019-02-18 17:18:00

Notifications (2/2)

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Virtual Machine Information

Name win10_64_th1
Description -
Architecture x86 64-bit
Operating System Windows 10 Threshold 1
Kernel Version 10.0.10240.16384 (c68ee22f-dcf6-4778-95c5-4a862be16567)
Network Scheme Name def
Network Config Name def

System Information

Computer Name LHNIWSJ
User Domain LHNIWSJ
User Name CIiHmnxMn6Ps
User Profile C:\Users\CIiHmnxMn6Ps
Temp Directory C:\Users\CIIHMN~1\AppData\Local\Temp
System Root C:\Windows
Sample Directory C:\Users\CIiHmnxMn6Ps\Desktop

Software Information

Adobe Acrobat Reader Version 18.009.20050
Microsoft Office Microsoft Office
Microsoft Office Version 16.0.11126.20196
Internet Explorer Version 11.0.10240.16384
Chrome Version 58.0.3029.110
Firefox Version 53.0.3
Flash Version 25.0.0.148
Java Version 8.0.1310.11
Microsoft Project Version 16.0.11126.20196
Microsoft Visio Version 16.0.11126.20196

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (23)
»
Filename PID GUI
C:\Program Files (x86)\Common Files\gaps.exe #1032 False
C:\Program Files (x86)\Common Files\reachesprocessingculture.exe #2772 False
C:\Program Files (x86)\Google\junctionbaseballsurname.exe #988 False
C:\Program Files (x86)\MSBuild\starts.exe #3084 True
C:\Program Files (x86)\Microsoft.NET\reefpunishmentcooking.exe #2684 False
C:\Program Files (x86)\Microsoft.NET\returned.exe #1208 False
C:\Program Files (x86)\Reference Assemblies\outcomes israeli runtime.exe #512 False
C:\Program Files (x86)\Reference Assemblies\sweden.exe #2780 False
C:\Program Files (x86)\Windows Media Player\relationshipcoleman.exe #700 False
C:\Program Files (x86)\Windows NT\nc-statements-inventory.exe #2104 False
C:\Program Files (x86)\Windows NT\radarunderground.exe #2704 False
C:\Program Files (x86)\Windows NT\skip-agreements-muscle.exe #1048 True
C:\Program Files (x86)\Windows Photo Viewer\regulatory chevy.exe #1924 False
C:\Program Files (x86)\Windows Sidebar\boundary.exe #2244 False
C:\Program Files\MSBuild\shift.exe #2768 False
C:\Program Files\Microsoft Office 15\different-ill.exe #3116 True
C:\Program Files\Reference Assemblies\recorder.exe #2576 False
C:\Program Files\Uninstall Information\strategic.exe #236 False
C:\Program Files\Windows Mail\collecting_vb_les.exe #928 False
C:\Program Files\Windows Media Player\hazards.exe #1804 False
C:\Program Files\Windows NT\absolute.exe #1568 False
C:\Program Files\Windows Photo Viewer\rings_ownership_printable.exe #832 False
C:\Program Files\Windows Portable Devices\ellen rw monica.exe #2872 True
Files (270)
»
Filename
C:\Users\CIIHMN~1\AppData\Local\Temp\2Hd6 mUyMjTDUE_9_Eyg.png
C:\Users\CIIHMN~1\AppData\Local\Temp\DMzM.wav
C:\Users\CIIHMN~1\AppData\Local\Temp\FLWide8GhSOdK8osz.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\J-e_A1IrPp71ZfmMHb.pdf
C:\Users\CIIHMN~1\AppData\Local\Temp\JBnIkeU.jpg
C:\Users\CIIHMN~1\AppData\Local\Temp\JPUKIevBXD22ld_w-C7Z.m4a
C:\Users\CIIHMN~1\AppData\Local\Temp\JcMvDv bYSwCG.png
C:\Users\CIIHMN~1\AppData\Local\Temp\My50USmlaMd0Ii.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\Pv42NbXzArbtwX.xls
C:\Users\CIIHMN~1\AppData\Local\Temp\SR7VrkYZhWnSTCtOyy.doc
C:\Users\CIIHMN~1\AppData\Local\Temp\VCrI0z2.avi
C:\Users\CIIHMN~1\AppData\Local\Temp\WKu9-FJd6Y7LXzcTll.pdf
C:\Users\CIIHMN~1\AppData\Local\Temp\Y_-Go_KNgd.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\a4-ZF2OEqatvJOGLq.mp4
C:\Users\CIIHMN~1\AppData\Local\Temp\aKmYASO.ppt
C:\Users\CIIHMN~1\AppData\Local\Temp\azugJ12KshLwxttRcSM.xlsx
C:\Users\CIIHMN~1\AppData\Local\Temp\bhLf3TYX7Wk4w5qlnBJU.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\kgX0s.wav
C:\Users\CIIHMN~1\AppData\Local\Temp\mq9IBKgpsg5FLW9N.gif
C:\Users\CIIHMN~1\AppData\Local\Temp\pYw9KnnZ.pps
C:\Users\CIIHMN~1\AppData\Local\Temp\tAFi.swf
C:\Users\CIIHMN~1\AppData\Local\Temp\w0iqKsh2D07jFASPH.mp3
C:\Users\CIIHMN~1\AppData\Local\Temp\wFI7MRZDAsGwHyt7aSnK.jpg
C:\Users\CIIHMN~1\AppData\Local\Temp\xKXybL86T.m4a
C:\Users\CIIHMN~1\AppData\Local\Temp\zeBQfPfvupM5hO9.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-f0 chr8O.ppt
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\021Ad.ods
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\14mifZbi6U7g.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1tGr2j OogF6b.swf
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\4YWEQ2GxGpdUwK8PTk.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7ciDl.jpg
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\B8CDRg.xls
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\H0n8vfZP F84hgjL.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\HcoyADAi5Sbnxpj.mkv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\I3aPKS.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\JBi-kk0FV6SxVr.png
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\JYaG7q.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\KZcK3fz60H0aS.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\MlklbQx-e.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\OQRDlux1AASf2Yv.png
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RqVYRuX.m4a
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RzsjBZcZllXZJRVXtlY.wav
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sd227.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\XLIMCYCuHSCE.jpg
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YkS_oztkhnLjlc1Hk2.flv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_vK0r9b9nfmo8rr.swf
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\aUzcWrREsGrojnF9hAS.mkv
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\aZf9Wm.avi
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\gR1CBuQqpVYIz.png
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ghU7s.docx
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\gzz6xbjl_LfVIYqAtg7n.gif
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\hIy5P_SVmm4d C3.xlsx
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\iBxnpfNq.swf
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\pflL.mp3
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\qcfzOGJP.ods
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\rJahNObUwfw7QQrXIp.avi
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\u5MvgM3W2.png
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\uy9N7OujPEEHlg4 _s.bmp
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\w- GEi38ff.swf
C:\Users\CIiHmnxMn6Ps\Desktop\0U1FYet.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\3 e7J3Up.wav
C:\Users\CIiHmnxMn6Ps\Desktop\30BtK.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\4TOB.swf
C:\Users\CIiHmnxMn6Ps\Desktop\51laWAqjIaVoS044Fk.rtf
C:\Users\CIiHmnxMn6Ps\Desktop\A-RD78l7Qlc9J.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\AzOBY.swf
C:\Users\CIiHmnxMn6Ps\Desktop\CtBf.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\DcpD3_p9.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\DmLPbKA PbBQzkgM.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\HhfN1hggoxlCjbyE9V5.flv
C:\Users\CIiHmnxMn6Ps\Desktop\NDJwvg.flv
C:\Users\CIiHmnxMn6Ps\Desktop\NHxpQXj.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\NwZQ.png
C:\Users\CIiHmnxMn6Ps\Desktop\ONmHCIawZAQ6l.wav
C:\Users\CIiHmnxMn6Ps\Desktop\RXVJC.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\SJKpPG7Gi7Gg_.swf
C:\Users\CIiHmnxMn6Ps\Desktop\VRacl0_hrlFRcTffeaIO
C:\Users\CIiHmnxMn6Ps\Desktop\VRacl0_hrlFRcTffeaIO\ZztZ.avi
C:\Users\CIiHmnxMn6Ps\Desktop\VRacl0_hrlFRcTffeaIO\sZ8kphpTDvI.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\XPkX.mkv
C:\Users\CIiHmnxMn6Ps\Desktop\YIZKTZac3L5eFR7x.avi
C:\Users\CIiHmnxMn6Ps\Desktop\Z_MqB_.ods
C:\Users\CIiHmnxMn6Ps\Desktop\a0bCx0.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\ckyl-mx28Ax_IC5.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\dbem3dR4dg5q7gd.gif
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\G9sQ-F5KGugZIDvv.mkv
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\Zs7Lv7v2QS.swf
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\eAcGdn.m4a
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\7Vis L VfHrcV53y.png
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\BNufPFwfyiVdnSt5.csv
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\ahKkwxcyM.avi
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\alhA3aUz
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\alhA3aUz\Ck wqS.mp3
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\alhA3aUz\rF0F83OeRTkaj.swf
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\iS9EkW
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\iS9EkW\HXpQea.avi
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\iS9EkW\Rm7mUg-xRozimEV7t.jpg
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\iS9EkW\S7Vw5e-7gWds.odp
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\iS9EkW\Why0.avi
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\iS9EkW\binhcrzS3ARBF.pdf
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\iS9EkW\frzRNZlwLH3r.bmp
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\fpvESJ\q0Z1ufk8.mp4
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\jZOzv1.avi
C:\Users\CIiHmnxMn6Ps\Desktop\f_RDBNJa3K3oZw0f\x5 95.wav
C:\Users\CIiHmnxMn6Ps\Desktop\m0a8-U9niTiMmRaq5uy.png
C:\Users\CIiHmnxMn6Ps\Desktop\xF SpMo9nNE7h.doc
C:\Users\CIiHmnxMn6Ps\Desktop\y2_-Obbq4hv4 Y.flv
C:\Users\CIiHmnxMn6Ps\Desktop\yu-0 63fuWb.bmp
C:\Users\CIiHmnxMn6Ps\Documents\275UOAN6kkvFlZMLH.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\5DbxKRWN.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\5EgiP9Nox7h.pptx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\94_Hb-8K5E.pdf
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\GhzE5QHKEIrI
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\GhzE5QHKEIrI\4KhSQHfpuUM.doc
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\O6IXT45vrI.docx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\VST Y0uLtO6PgOIQ1J0Z.rtf
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\3M1hZqKtYrnXF.ots
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\3_9Haky2wfv1A.odt
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\8K_dM0xOUIdny.docx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\ZNcrgZDa54J.xls
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\3tz7peEsTvuM
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\3tz7peEsTvuM\-oOIqjsx.pptx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\3tz7peEsTvuM\3f6.doc
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\3tz7peEsTvuM\H2oUzN2O5wyQpegn.rtf
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\3tz7peEsTvuM\jB1KmBPKOsPd5n.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\3tz7peEsTvuM\wKYC4P0MQNEcrxpHkE.xls
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\3tz7peEsTvuM\xyZt08shq3IZ.odt
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\0PJbRt.ppt
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\UiqWmFHO_sEKaTitan.pptx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\XN6 EA.pdf
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\eUDfQARDF6x.odt
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\GQLgktaZ.doc
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\cJVF42pEm2_iaxQ8x.csv
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\6hr7PuTfGJYnsw.csv
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\7tuUT_3cI-UJwB
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\7tuUT_3cI-UJwB\JsURb8PXUUyeqY.xls
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\7tuUT_3cI-UJwB\Pi5DLycnMA-.pps
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\7tuUT_3cI-UJwB\ZgaaFByxvb.doc
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\7tuUT_3cI-UJwB\fOjRhg2hhyTl9f.pdf
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\7tuUT_3cI-UJwB\fTVPj4GiPQZC6V3o4.odt
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\7tuUT_3cI-UJwB\wlly.pptx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\VOUJwwsAq6X.docx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\c548WJ5bDz2QDCDTDVr.ods
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\xZw b4g_JOTbFhsht.csv
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\fV1MCunDF-l\xsjJQe16kOCXU29WGcCJ.ppt
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\mgfIrqsWdR.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\piHuZRAz9dNWq
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\piHuZRAz9dNWq\-BS4mF.xls
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\piHuZRAz9dNWq\iRG4QnoO.ppt
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\8BuD32sh60PWiwp\oT6owYuaL\vtDv KkQvZ_mFSwACuc.docx
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\uXcvp3mK09d\u1aeOBLb_6Tqy6I\PGPibvMt.pps
C:\Users\CIiHmnxMn6Ps\Documents\9BBF2RyCvM\vW_oXWtlIV.ots
C:\Users\CIiHmnxMn6Ps\Documents\AVyoVSF.ots
C:\Users\CIiHmnxMn6Ps\Documents\H K80AC.docx
C:\Users\CIiHmnxMn6Ps\Documents\JXW3nsm.pptx
C:\Users\CIiHmnxMn6Ps\Documents\QC3dt.pptx
C:\Users\CIiHmnxMn6Ps\Documents\T1cl1qp.pptx
C:\Users\CIiHmnxMn6Ps\Documents\TmFS9Ckm0dkXXbzGD5.docx
C:\Users\CIiHmnxMn6Ps\Documents\UeCPKGD3se3f1.docx
C:\Users\CIiHmnxMn6Ps\Documents\XvytobGD.xls
C:\Users\CIiHmnxMn6Ps\Documents\Z7ACw4QJjvpy.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\aIz1pjrpDB7p-TmwYt.docx
C:\Users\CIiHmnxMn6Ps\Documents\eYhWJ RqdozFpqHroL5W.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\iIXvH.xlsx
C:\Users\CIiHmnxMn6Ps\Documents\jAgptK-j5gW.docx
C:\Users\CIiHmnxMn6Ps\Documents\rlNIYIXIjsW.pptx
C:\Users\CIiHmnxMn6Ps\Documents\vJwuNaFee.doc
C:\Users\CIiHmnxMn6Ps\Music\0VWyNHahluafpdFSUYC.m4a
C:\Users\CIiHmnxMn6Ps\Music\1Jvic71.m4a
C:\Users\CIiHmnxMn6Ps\Music\2kfHC5FToJZjQ_2Uuks.wav
C:\Users\CIiHmnxMn6Ps\Music\HMjA43nguHpnFAxjSxa.m4a
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\CwOfBeLcuC8N.wav
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\Dg d.wav
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\Zver54ov-SCrdXAJ.mp3
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\a-jg.m4a
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\bYWQ.m4a
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\iBXXygv.mp3
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\qwBF.wav
C:\Users\CIiHmnxMn6Ps\Music\VpI4NfJ\sEcflb.mp3
C:\Users\CIiHmnxMn6Ps\Music\bf8bO.m4a
C:\Users\CIiHmnxMn6Ps\Music\lvEA9qdqTLwYH-_S9b.mp3
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\5Svb7CtHnlv9cG.wav
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\9PsjFY-F PSzjx.mp3
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\Eb1Q7fUwCA2DHE.m4a
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\J-oNhvvRbn azz.wav
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\LjY8Q.m4a
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\OxXKE7MmkWg9dzN.mp3
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\RNgrw.m4a
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\fPu5rMcj8Fp4K1.mp3
C:\Users\CIiHmnxMn6Ps\Music\sSxPZkKuqdeph\uPotTL6igW.wav
C:\Users\CIiHmnxMn6Ps\Music\ttZsnsx-5qu7lA.mp3
C:\Users\CIiHmnxMn6Ps\Music\u-oADGwEFEJixX.wav
C:\Users\CIiHmnxMn6Ps\Pictures\3PVHyEjKu.png
C:\Users\CIiHmnxMn6Ps\Pictures\7vyfk2YzGvFDhoGguhe
C:\Users\CIiHmnxMn6Ps\Pictures\7vyfk2YzGvFDhoGguhe\9r4DL.png
C:\Users\CIiHmnxMn6Ps\Pictures\7vyfk2YzGvFDhoGguhe\emJ3ZNvJOxwkrKOed0kc.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\7vyfk2YzGvFDhoGguhe\v2h uSr5.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\HqptcqKhb rKrn.png
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\h1Bf6lmj.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\o6NGpRJy.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\N5MNejrqSH2rgwdQdper.png
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\PSUCe_di5jRXKawO3C60.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\_4Hkn.gif
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\3DbDWjZltZQ
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\3DbDWjZltZQ\3UaE2H4hje.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\3DbDWjZltZQ\6eApIP HV.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\3DbDWjZltZQ\pGm56TTUh5c hWZu.png
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\3DbDWjZltZQ\qD wcp2Y53LlgRglr8_t.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\9JLzUbTiz6
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\9JLzUbTiz6\lPkOLyg3SygPqM.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\9JLzUbTiz6\zmN-bRUBdO1_f9B32.png
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\BCXVw0NtX.gif
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\EXjve3jGvH0u_m.gif
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\3fMls7\KwBNqPqafvMJVN.gif
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\nStrFlun.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\dp__bieng9\t dlC.bmp
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\mZwy6pg ON
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\mZwy6pg ON\a 0e_Zi0AwJ3T.jpg
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\mZwy6pg ON\wx1pEowPOYWi
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\mZwy6pg ON\wx1pEowPOYWi\b4Lpcrx.gif
C:\Users\CIiHmnxMn6Ps\Pictures\V_u2\r7lDY-Y1hTWn\rB7m3FfliMS_mI8U6Mp.gif
C:\Users\CIiHmnxMn6Ps\Pictures\y1mF
C:\Users\CIiHmnxMn6Ps\Pictures\y1mF\Z5FgCbIeuCS.gif
C:\Users\CIiHmnxMn6Ps\Pictures\y1mF\ozCtv44EA.gif
C:\Users\CIiHmnxMn6Ps\Videos\4_IDTqB ZlS-w7.mp4
C:\Users\CIiHmnxMn6Ps\Videos\8h2T0TOTp1FE793l0V5z.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\1sEw_wY8.mp4
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\EX_3P8.avi
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\FkeyX3zUJmV7_VQl.swf
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\Jsd4BSiqfKBc1.mp4
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\KyZTn6pjXDziIBU471.avi
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\1m--rBjd9UI99dS.swf
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\8aYToX1.swf
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\e1GFB.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX\61CNZp0_g.flv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX\Gy7DNsp.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX\UjvYO54xgHAwG5p6N.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX\hM005B.mp4
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX\lAlb8NgT1Hf h_.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX\rHtdv.mp4
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\8_KuX\yZ6Zvf__RXgl8iu3.mp4
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\LKAlvv468QzU1uc\pFJx7JDxO1-0GIQE\ABspsBD.flv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\QJlG0ayf3eEvs
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\QJlG0ayf3eEvs\Z6WO.mkv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\QJlG0ayf3eEvs\g3W5BQOIYhiNTGdOr8.swf
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\QJlG0ayf3eEvs\rt_f3WaKPJuK49r_W.flv
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\QJlG0ayf3eEvs\t7mOwgHt0Gu9bIDN.avi
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\nBDgucKgi.mp4
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\pT-rl7dzeiGs9hwF4kXK
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\pT-rl7dzeiGs9hwF4kXK\KPqlCrGF.swf
C:\Users\CIiHmnxMn6Ps\Videos\XszTLjK GHoiKt1rd\ffP1p0bC-Op3oB\r1Vi6EXgtM3SX.avi
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image