IQY File uses PowerShell to Download a Malicious .exe | Environment
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Backdoor, Trojan, Dropper, Downloader

76917b219ad5a1ff8229a75eb23c34a9ad1ce98264257d3cca538ac59c49a15f (SHA256)

29082018_64943.iqy

Excel Document

Created at 2018-08-30 14:38:00

...

Notifications (1/1)

The operating system was rebooted during the analysis.

Virtual Machine Information

Name win7_64_sp1-mso2013
Description -
Architecture x86 64-bit
Operating System Windows 7
Kernel Version 6.1.7601.17514 (3844dbb9-2017-4967-be7a-a4a2c20430fa)

System Information

Computer Name AUFDDCNTXWT
User Domain AUFDDCNTXWT
User Name aDU0VK IWA5kLS
User Profile C:\Users\aDU0VK IWA5kLS
Temp Directory C:\Users\ADU0VK~1\AppData\Local\Temp
System Root C:\Windows
Sample Directory C:\Users\aDU0VK IWA5kLS\Desktop

Software Information

Adobe Acrobat Reader Version 10.0.0
Microsoft Office 2013
Microsoft Office Version 15.0.4569.1504
Internet Explorer Version 8.0.7601.17514
Chrome Version 59.0.3071.115
Firefox Version 25.0
Flash Version 11.2.202.233
Java Version 7.0.710.14
Microsoft Project Version 15.0.4569.1504
Microsoft Visio Version 15.0.4420.1017

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (18)
»
Filename PID GUI
C:\Program Files (x86)\Internet Explorer\isolation.exe #860 False
C:\Program Files (x86)\Internet Explorer\psychology-leaving-examinations.exe #388 True
C:\Program Files (x86)\Java\c-weird-baskets.exe #564 False
C:\Program Files (x86)\Java\objectives-bailey-audit.exe #712 False
C:\Program Files (x86)\Microsoft Analysis Services\ship-loans.exe #1088 False
C:\Program Files (x86)\Microsoft Office\previous_automation_previously.exe #1216 False
C:\Program Files (x86)\Microsoft SQL Server\calls ccd copyright.exe #684 False
C:\Program Files (x86)\Microsoft SQL Server\laptop-tattoo.exe #328 False
C:\Program Files (x86)\Microsoft.NET\abc.exe #560 False
C:\Program Files (x86)\Reference Assemblies\sayconvenience.exe #1680 True
C:\Program Files (x86)\Windows Portable Devices\english_performing.exe #1180 False
C:\Program Files\Common Files\tri.exe #528 False
C:\Program Files\Microsoft Analysis Services\volume.exe #1276 False
C:\Program Files\Uninstall Information\rich-zealand.exe #1392 False
C:\Program Files\Windows Journal\puzzle-fcc-tuesday.exe #1744 False
C:\Program Files\Windows Photo Viewer\chevrolet-play-mel.exe #1428 False
C:\Program Files\Windows Photo Viewer\clause_swaziland_complimentary.exe #2000 False
C:\Program Files\Windows Portable Devices\navigation-jay.exe #1852 False
Files (263)
»
Filename
C:\Users\ADU0VK~1\AppData\Local\Temp\-LTFuqp.mp4
C:\Users\ADU0VK~1\AppData\Local\Temp\2m9CCMxU.jpg
C:\Users\ADU0VK~1\AppData\Local\Temp\8AZd.mkv
C:\Users\ADU0VK~1\AppData\Local\Temp\D8zZsSVz-8RP9ZdPfH7.m4a
C:\Users\ADU0VK~1\AppData\Local\Temp\DXZs_6rnBZagi.flv
C:\Users\ADU0VK~1\AppData\Local\Temp\ErV11L80Bv.wav
C:\Users\ADU0VK~1\AppData\Local\Temp\HBOKixbIxv n _0uPI89.jpg
C:\Users\ADU0VK~1\AppData\Local\Temp\M8htzWtV9h8BPH41.odt
C:\Users\ADU0VK~1\AppData\Local\Temp\NALI.bmp
C:\Users\ADU0VK~1\AppData\Local\Temp\NmRFREbRS.odt
C:\Users\ADU0VK~1\AppData\Local\Temp\PBLxKnSL.flv
C:\Users\ADU0VK~1\AppData\Local\Temp\PutRVlK.mp3
C:\Users\ADU0VK~1\AppData\Local\Temp\RnOWIzbGhrCtdmt.wav
C:\Users\ADU0VK~1\AppData\Local\Temp\RnzWKtqBul4vZv.swf
C:\Users\ADU0VK~1\AppData\Local\Temp\SfXIp.gif
C:\Users\ADU0VK~1\AppData\Local\Temp\T8A_gyp8ZW-W5eDYV.jpg
C:\Users\ADU0VK~1\AppData\Local\Temp\aH4R9ZSxJfTp35gT.mp3
C:\Users\ADU0VK~1\AppData\Local\Temp\cBwH.mp3
C:\Users\ADU0VK~1\AppData\Local\Temp\d01RVHrkgG.mp4
C:\Users\ADU0VK~1\AppData\Local\Temp\e-qgyW6YFjepYdDYa.xls
C:\Users\ADU0VK~1\AppData\Local\Temp\g6Dz8sfi.swf
C:\Users\ADU0VK~1\AppData\Local\Temp\hOa-HNN0_.jpg
C:\Users\ADU0VK~1\AppData\Local\Temp\jqZFtg5d.bmp
C:\Users\ADU0VK~1\AppData\Local\Temp\kKHx6.wav
C:\Users\ADU0VK~1\AppData\Local\Temp\nqx7ssjrGc4rWV.gif
C:\Users\ADU0VK~1\AppData\Local\Temp\r3OsCdAdeUt.mp4
C:\Users\ADU0VK~1\AppData\Local\Temp\vA4ojA43.jpg
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\-36puTJL.mp4
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\00QJGM-6lQPMKKNCjm.jpg
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\0tkfZZmrGF.doc
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\2WZAr8EB.jpg
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\3 MvzQZ2duJmEXcsBH6.mp4
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\6CMW7a4-V3HVMN2Vi.mp4
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\6Jd3kj1fPr9Oxh1OP.mp4
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\8sIVr9IZPrE.wav
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\EVfqusUwi9gsqg-Vf7.avi
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\ITICgxPj9jGV4.mp4
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\J3gb.mp3
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\Ne_o3dWrk.csv
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\OeaVNWRmeR5HG1dHEDe.gif
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\OjX_QgwmRqK30v2.gif
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\P2wUlLjYqiMLRQ1TR.flv
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\Qj4zksLRvQx6GY.wav
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\UwqautKuR.csv
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\VpM8bn1GbLokP-XeLQwe.pptx
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\_AftpOMYvb6.doc
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\b1UEAbZfkzL.xlsx
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\b5uD.pps
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\c QnzwygwdLdi-mu.gif
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\cfdzkzo.m4a
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\dJZ5B7-M.mkv
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\f2TTXsR8Yd.avi
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\f9cwbLHhfRP7KYa3.mp3
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\hqSqW4aCxG.pps
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\irP5OYNXGbf.ods
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\lVVlE9L2LHDN1KQ.swf
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\nET-lRMbogO.xls
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\q-LMTvc s0qWHcZ5VWH.bmp
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\qtI4A.xlsx
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\tte1.mp3
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\wRkuar.gif
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\wmlqQfIxS S5drIYpR.pptx
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\x0yDl jIyUGd5.avi
C:\Users\aDU0VK IWA5kLS\AppData\Roaming\y6oyRVkNehPOApCP.m4a
C:\Users\aDU0VK IWA5kLS\Desktop\1-jXqpJhLPkMt.png
C:\Users\aDU0VK IWA5kLS\Desktop\15gfLjipB8 6AAeq.avi
C:\Users\aDU0VK IWA5kLS\Desktop\1dHbmw-i8KR0w.avi
C:\Users\aDU0VK IWA5kLS\Desktop\6D88dvSBk_Y4xDmNPw7.m4a
C:\Users\aDU0VK IWA5kLS\Desktop\6iVYXGis.odp
C:\Users\aDU0VK IWA5kLS\Desktop\7oUPqZn4iNojpMHZW-R.pptx
C:\Users\aDU0VK IWA5kLS\Desktop\DN_weFta3ipy0Emwdrw.png
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\48ixInaDcs E3VshN.png
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\BPuWZ7KRlDJ.m4a
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\Fbmj8lg_kuIhUtf0Y.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\O6SiO_qdt4tvS3D.gif
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\VYn6_ Zutvnsa.odp
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\fZfQr-oWIoXyNxPBsYg.odp
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\fgSPKkFJSmLt.odt
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\fxjfS4ynhMgp_SfkR_EJ.mp3
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\lYfu8GV01Zt6Xd.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\y7scM8D3MH68.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\FXkycZG\z2ZrcJd7.avi
C:\Users\aDU0VK IWA5kLS\Desktop\Ft7FMRGiqhRXAuXi.gif
C:\Users\aDU0VK IWA5kLS\Desktop\FxVtd.gif
C:\Users\aDU0VK IWA5kLS\Desktop\IjHzbo.mp3
C:\Users\aDU0VK IWA5kLS\Desktop\IuZQtmuiflMzgyda.wav
C:\Users\aDU0VK IWA5kLS\Desktop\JN8zHyGNKLimUjtx.png
C:\Users\aDU0VK IWA5kLS\Desktop\KCvFPuBWwbO.mkv
C:\Users\aDU0VK IWA5kLS\Desktop\NkPniXSMIQG.pptx
C:\Users\aDU0VK IWA5kLS\Desktop\OnR31R24ncISu2.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\Ui394p.avi
C:\Users\aDU0VK IWA5kLS\Desktop\Xe-zdgr1ejDW8Aiv.gif
C:\Users\aDU0VK IWA5kLS\Desktop\Xnlc.bmp
C:\Users\aDU0VK IWA5kLS\Desktop\YGQTtfDnzT3EIrh4.png
C:\Users\aDU0VK IWA5kLS\Desktop\Zfn_zA9.pdf
C:\Users\aDU0VK IWA5kLS\Desktop\a1ANDJHa3Mm2qTXm.mp4
C:\Users\aDU0VK IWA5kLS\Desktop\eDEoZ42i5U00.m4a
C:\Users\aDU0VK IWA5kLS\Desktop\i asGnb3bMaup.mkv
C:\Users\aDU0VK IWA5kLS\Desktop\iDU YR.mp3
C:\Users\aDU0VK IWA5kLS\Desktop\k6XmVRWWn.pptx
C:\Users\aDU0VK IWA5kLS\Desktop\nNZD.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\stJ-bd_eVV9.mkv
C:\Users\aDU0VK IWA5kLS\Desktop\tY1Hqgkd0rP4 sUMQ.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\tkSqfWeOURIOGPgDZXG.csv
C:\Users\aDU0VK IWA5kLS\Desktop\ucdQt51n wTI3hsgGgzF.mp3
C:\Users\aDU0VK IWA5kLS\Desktop\wOyQqJMOmu9m3j9q.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\wkv p.jpg
C:\Users\aDU0VK IWA5kLS\Desktop\xc4md8.wav
C:\Users\aDU0VK IWA5kLS\Documents\2lRpdIYVsXGqT.docx
C:\Users\aDU0VK IWA5kLS\Documents\4asaweWVPa4zHM7E35.pptx
C:\Users\aDU0VK IWA5kLS\Documents\5hatJ_I9I.pptx
C:\Users\aDU0VK IWA5kLS\Documents\6Khbu_PABkNeZI1UL.docx
C:\Users\aDU0VK IWA5kLS\Documents\76-L87.pptx
C:\Users\aDU0VK IWA5kLS\Documents\B72dWwIgRetE.docx
C:\Users\aDU0VK IWA5kLS\Documents\FijYLW.docx
C:\Users\aDU0VK IWA5kLS\Documents\L4Eij6bLn3.xlsx
C:\Users\aDU0VK IWA5kLS\Documents\Li qq_ErjPkP.pptx
C:\Users\aDU0VK IWA5kLS\Documents\MJnJxjQ5V7c.pdf
C:\Users\aDU0VK IWA5kLS\Documents\P-agV8D1l.ppt
C:\Users\aDU0VK IWA5kLS\Documents\RceV7T5 NT3.pptx
C:\Users\aDU0VK IWA5kLS\Documents\Rde72dmQOBaGK0Eqe.rtf
C:\Users\aDU0VK IWA5kLS\Documents\Vz-L2 AzyMzii8mWym.docx
C:\Users\aDU0VK IWA5kLS\Documents\YCCsTdZ8Qt2.docx
C:\Users\aDU0VK IWA5kLS\Documents\Yr-kf.pdf
C:\Users\aDU0VK IWA5kLS\Documents\dKMq-96Zz6BSfMGF.xlsx
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\-LNX2AjxFy0A27cmR_.pps
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\3YMVaQWk.ots
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\7W1zHjt2F.ppt
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\BiUkQ9Ny25B_tzQQ.ots
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\CSfI0FM-g.ots
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\DeYV1JRUuCsktlSo.xls
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\DzKbuPFj6UPvKa8hafW9.ots
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\RWaU.doc
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\es_aRM.pptx
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\g3bdq677h6WbX.pps
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\lQpQ.rtf
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\mERn68 r.doc
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\pPU2Xo.pdf
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\pmKabZ-BfxEAb2ZmdZ7d.doc
C:\Users\aDU0VK IWA5kLS\Documents\fP6tCG_fYtFG33IS8fWG\sftrHdi.ods
C:\Users\aDU0VK IWA5kLS\Documents\fbRm31tF.xlsx
C:\Users\aDU0VK IWA5kLS\Documents\kMhfSBGl49l9ZMfXig0.doc
C:\Users\aDU0VK IWA5kLS\Documents\li5Wa_o8I.pptx
C:\Users\aDU0VK IWA5kLS\Documents\mZqRIMz.pdf
C:\Users\aDU0VK IWA5kLS\Documents\mfaQ1YRrCv-oW.xlsx
C:\Users\aDU0VK IWA5kLS\Documents\ml_vzkYtG6UTPePuy.docx
C:\Users\aDU0VK IWA5kLS\Documents\sAZzhc-RKW.pptx
C:\Users\aDU0VK IWA5kLS\Documents\vCMRJv-M.pps
C:\Users\aDU0VK IWA5kLS\Documents\yzec25nNVE.xlsx
C:\Users\aDU0VK IWA5kLS\Documents\zAuMM9pTLkr VA_Wb9.xlsx
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\AyclbEu92TrAswi.wav
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\I8E_Hh.wav
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\JxAWmwlO.m4a
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\S0RXZMVQTNk.m4a
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\WqrnbYrFC2.m4a
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\XiI9mrQam5Zes pe.m4a
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\Z3giuNuljCNF.m4a
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\_mhx7TCX1cDaPzkkpl.mp3
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\cJXdn.wav
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\gfueFO.wav
C:\Users\aDU0VK IWA5kLS\Music\2Jc-jxFEzNvJSF\mU7t6D7PcADVO5_qyC.wav
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\8jo8fav2beL86yar.mp3
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\9h-6KMkzLeOGK2ItiOw.m4a
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\EGBCprzBu.m4a
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\Ua8h4V00 eYCBzvbZ.m4a
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\VpWgLGyh907fZMZa6FK.wav
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\XU0XY_MP2Tuh-g.mp3
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\XWxbrMXKO6lWH1grG.mp3
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\lUTo14.mp3
C:\Users\aDU0VK IWA5kLS\Music\2pzpXg2WRPRl3p240Xk\mueK2NV01P0a.m4a
C:\Users\aDU0VK IWA5kLS\Music\58b4GJSE ZwGU.wav
C:\Users\aDU0VK IWA5kLS\Music\8InRBN.wav
C:\Users\aDU0VK IWA5kLS\Music\HBWN-1UEFtPLMUov0.mp3
C:\Users\aDU0VK IWA5kLS\Music\QibyPUJcufGWHlk P.wav
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn\0KcgZNE.wav
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn\4HP9pWpyO.m4a
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn\QlTehIYgjjCU-GV5.mp3
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn\TLDkM9h20e gz.wav
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn\Uov61roqkD5j5.mp3
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn\hYDWIb.wav
C:\Users\aDU0VK IWA5kLS\Music\RL-mf6xsI-pxn\mzYx1L.wav
C:\Users\aDU0VK IWA5kLS\Music\WuIPlk83lP8EzdU4JN.m4a
C:\Users\aDU0VK IWA5kLS\Music\gSvuaXBFS.m4a
C:\Users\aDU0VK IWA5kLS\Music\iYekm-FqNgG.wav
C:\Users\aDU0VK IWA5kLS\Music\xojFT4fVl3zoqD72.wav
C:\Users\aDU0VK IWA5kLS\Pictures\7Mig m1BV.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\9TYZLlrdES6oSBk.png
C:\Users\aDU0VK IWA5kLS\Pictures\ASyvxuh.gif
C:\Users\aDU0VK IWA5kLS\Pictures\RsaDZwZICu6_vSiKqu.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\TCW5LD3p.png
C:\Users\aDU0VK IWA5kLS\Pictures\VkxfJzWx7xRBO8IqE2bS.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\e7v29nzD.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\3KrmdsOX.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\OWfxivh2Ygd5pnwcut.png
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\CcMxu
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\CcMxu\DdNx50-tiNYEYNUBrZ.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\CcMxu\mgB3N_03uZ3dfx3FyT3.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\Jxwk.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\fKwQLssa6bLl1n.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\fl7bqT8K- 6ryhSH.png
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\jmsrIGhTL.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\0Al_2O9FSjay mWUfjZ.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\8MM9AKilZVu7YQ87P.gif
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\INyYZe.gif
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\LOWi92.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\NmnM7_BcrGRWLPzZ_.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\QSnb1bJ_-6o.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\WkMXkX9VuBo8F.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\YDX RzuKNPTgw9voPLN
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\YDX RzuKNPTgw9voPLN\-brxHM6e.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\YDX RzuKNPTgw9voPLN\7ZGtDIC2sC9.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\YDX RzuKNPTgw9voPLN\bRMPYQ9o7obh6LRZ4yO.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\YDX RzuKNPTgw9voPLN\i 9cbC8.gif
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\YDX RzuKNPTgw9voPLN\iXS1O5.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\rEWtuIrqqvisuoUZ\sy5ebqky08F9EMdCYL T.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\seo.jpg
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\TZoMlM5YOsr8dzf\wP_bX1TZd.gif
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\YCunTeNSv8N_.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\fNi3QVHpJmOegTGcnK8.gif
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\iayc zUP.gif
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\s72uLDnit.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\tncKtkvX81GPHK EWg.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\fgZNCc9qA\vSPl0NU6njY6DXZ_K1Z.bmp
C:\Users\aDU0VK IWA5kLS\Pictures\iMppAopausSIvZ8.jpg
C:\Users\aDU0VK IWA5kLS\Videos\0odaR2GO.swf
C:\Users\aDU0VK IWA5kLS\Videos\EdOZIPJy-HB
C:\Users\aDU0VK IWA5kLS\Videos\EdOZIPJy-HB\-lIKRwd.avi
C:\Users\aDU0VK IWA5kLS\Videos\EdOZIPJy-HB\EQuA xDeStYH-OLXpTH.avi
C:\Users\aDU0VK IWA5kLS\Videos\EdOZIPJy-HB\G3DLY.flv
C:\Users\aDU0VK IWA5kLS\Videos\EdOZIPJy-HB\GchO6PQ4VXyCiP.mkv
C:\Users\aDU0VK IWA5kLS\Videos\EdOZIPJy-HB\VvEV.avi
C:\Users\aDU0VK IWA5kLS\Videos\EdOZIPJy-HB\f_xC5jorNX11aMznT.mkv
C:\Users\aDU0VK IWA5kLS\Videos\Gcpc6mN.mkv
C:\Users\aDU0VK IWA5kLS\Videos\QZK9-4oa.avi
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\C gBy0p.mp4
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\HXBQAoZ.mkv
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\NPaUorr0M8OY1MAd.flv
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\ROLd5svT7EnJay.flv
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\ZKTYGqqetynD-oYIJDBH.mkv
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\bEnOUiUa0OtRonnCCZI.swf
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\v16nyS2epab.swf
C:\Users\aDU0VK IWA5kLS\Videos\YlFvQZDiDGN\zX17u -mHy4_1Gcl.avi
C:\Users\aDU0VK IWA5kLS\Videos\eDuGAqkeoE8.flv
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV\5SsD b 2--Wm9__5TlN.swf
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV\5mhxU3goKXoqS1u DW
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV\5mhxU3goKXoqS1u DW\1Mmx3uAZ.mkv
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV\5mhxU3goKXoqS1u DW\VunRVGUM914MF.mp4
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV\AYf_py9WUM.mp4
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV\YA6LxF9bOPv4tRY.mkv
C:\Users\aDU0VK IWA5kLS\Videos\i3SHfMO VQstAVOV\yxQYSEfZ29meHip5QW.flv
C:\Users\aDU0VK IWA5kLS\Videos\k6NA5YUdOd.swf
C:\Users\aDU0VK IWA5kLS\Videos\mfXj9jf2Xo-3g OXZ_.avi
C:\Users\aDU0VK IWA5kLS\Videos\pdv5CfOZNuaWG2eMfr.swf
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image