Comnie dropper | Environment
Try VMRay Analyzer
VTI SCORE: 95/100
Dynamic Analysis Report
Classification: Trojan, Dropper

ea4a4162cd6ffad02d142c48067c1239253f688b8f163fd2887229d8a3240253 (SHA256)

addin.xlam.xls

Excel Document

Created at 2018-08-05 19:41:00

Virtual Machine Information

Name win10_64
Description Windows 10 (64-bit), MS Office 2016 (64-bit)
Architecture x86 64-bit
Operating System Windows 10 Threshold 2
Kernel Version 10.0.10586.0 (0de6dc23-8e19-4bb7-8608-d54b1e6fa379)

System Information

Computer Name X2VS1CUM
User Domain X2VS1CUM
User Name Nd9E1FYi
User Profile C:\Users\Nd9E1FYi
Temp Directory C:\Users\Nd9E1FYi\AppData\Local\Temp
System Root C:\Windows
Sample Directory C:\Users\Nd9E1FYi\Desktop

Software Information

Adobe Acrobat Reader Version 15.007.20033
Microsoft Office 2016
Microsoft Office Version 16.0.4266.1001
Internet Explorer Version 11.0.10586.0
Chrome Version 60.0.3112.113
Firefox Version 55.0.2
Flash Version 25.0.0.148
Java Version 8.0.1440.1

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (20)
»
Filename PID GUI
C:\Program Files (x86)\Common Files\coming-macintosh.exe #3100 False
C:\Program Files (x86)\Google\object.exe #4020 False
C:\Program Files (x86)\Internet Explorer\firewire-promotions.exe #3800 False
C:\Program Files (x86)\MSBuild\collecting-nano.exe #3692 False
C:\Program Files (x86)\Microsoft Analysis Services\parentstrialbk.exe #3920 False
C:\Program Files (x86)\Mozilla Maintenance Service\avatar_into.exe #2732 False
C:\Program Files (x86)\Mozilla Maintenance Service\fact.exe #3840 False
C:\Program Files (x86)\Reference Assemblies\outcome.exe #3860 False
C:\Program Files (x86)\Reference Assemblies\passannouncedcambridge.exe #3680 False
C:\Program Files (x86)\Windows Mail\aka iso.exe #3968 False
C:\Program Files (x86)\Windows Mail\beast install.exe #3520 False
C:\Program Files (x86)\Windows NT\soviet.exe #2352 False
C:\Program Files (x86)\Windows Portable Devices\tariffran.exe #4000 False
C:\Program Files\Uninstall Information\seasons political lawsuit.exe #3896 False
C:\Program Files\Windows Mail\respiratory.exe #3912 False
C:\Program Files\Windows NT\nicechevy.exe #3092 False
C:\Program Files\Windows NT\primarily-knowledge-univ.exe #3880 False
C:\Program Files\Windows Portable Devices\platinumfilms.exe #3940 False
C:\Program Files\Windows Portable Devices\weekends twins.exe #2892 False
C:\Program Files\Windows Sidebar\wyoming_flows_extending.exe #3820 False
Files (308)
»
Filename
C:\Users\Nd9E1FYi\AppData\Local\Temp\-8ue5lwIlIVdr.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\0Sf oS.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\2s-d58Be7AFwnK.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\59LwOvpge2VRa.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\Cog-RW34zqGCk.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\CxhKCdiGGLgSwXmCL.odp
C:\Users\Nd9E1FYi\AppData\Local\Temp\Fe-M.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\GO9E H.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\QEzLG8f_RBvwE.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\Yo7QeFMH0lodNY7UNqv.ots
C:\Users\Nd9E1FYi\AppData\Local\Temp\ZS4Sh3.jpg
C:\Users\Nd9E1FYi\AppData\Local\Temp\Zj4eVmqY37j.bmp
C:\Users\Nd9E1FYi\AppData\Local\Temp\_VxqJTex4xLMB--.rtf
C:\Users\Nd9E1FYi\AppData\Local\Temp\_lle.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\aL7Cau JluQY1P_KNY.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\aso-09bk3rtTeuQ5Wt.png
C:\Users\Nd9E1FYi\AppData\Local\Temp\dnyQgNgWK4BpWu_.xls
C:\Users\Nd9E1FYi\AppData\Local\Temp\gF99H1MFljFqOT2kW7.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\hkTAkr3.pdf
C:\Users\Nd9E1FYi\AppData\Local\Temp\jttUlVkgpC-SywUkJ.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\lUATxx.doc
C:\Users\Nd9E1FYi\AppData\Local\Temp\mtz09.png
C:\Users\Nd9E1FYi\AppData\Local\Temp\oj9M.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\qzL NFGl3FOBAcHjV.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\s5G84pjv4Sv2Lzn0jGb.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\se3w7Ofp7y46kiri.ots
C:\Users\Nd9E1FYi\AppData\Local\Temp\wGvdeAMkSkf.odt
C:\Users\Nd9E1FYi\AppData\Local\Temp\wv_Q6DNozNRg9oUz59.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\zWpVDFRYW.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\ziQpgwKaV.ots
C:\Users\Nd9E1FYi\AppData\Roaming\0Ez1Exdl_Uqqpui.flv
C:\Users\Nd9E1FYi\AppData\Roaming\0PzFZCC.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\1PsbJVkYWxJ9xIOFI.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\1rT9jOc.swf
C:\Users\Nd9E1FYi\AppData\Roaming\6YxLTmbomdWDV3de.pptx
C:\Users\Nd9E1FYi\AppData\Roaming\7yag7Vw6to58BQtQzmeV.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\8IiHmIGQu 9Au.flv
C:\Users\Nd9E1FYi\AppData\Roaming\B2xpizhVUeBrOQP.wav
C:\Users\Nd9E1FYi\AppData\Roaming\FVKCj.wav
C:\Users\Nd9E1FYi\AppData\Roaming\GeGMnWBgmx3u66jVebGD.wav
C:\Users\Nd9E1FYi\AppData\Roaming\GjI2P59Uxb5u a.gif
C:\Users\Nd9E1FYi\AppData\Roaming\Hv4V9E3LinQ7XDU k.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\IXMNS_JaoZ.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\IyuDP8wTl4tdQ.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\JfwPY2KUll7SGb0e.ots
C:\Users\Nd9E1FYi\AppData\Roaming\L5AZ9H3N4.swf
C:\Users\Nd9E1FYi\AppData\Roaming\NJcvkse2YLCi5SO.ots
C:\Users\Nd9E1FYi\AppData\Roaming\P2f8Waed3.docx
C:\Users\Nd9E1FYi\AppData\Roaming\UIoyyixoCCNfInd210X.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\Un9 ESoh1SHxB83EI9.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\YSwaW.xlsx
C:\Users\Nd9E1FYi\AppData\Roaming\YsJ.wav
C:\Users\Nd9E1FYi\AppData\Roaming\auoeUHPk7EbUToyR.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\bR7BTf5ZUKa7kDokrMs.mkv
C:\Users\Nd9E1FYi\AppData\Roaming\bYCH7lZD3v.avi
C:\Users\Nd9E1FYi\AppData\Roaming\eoP JpBb.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\g HZEwil9ZCkB.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\gAh 1RteNx- M.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\gHzkLITx.avi
C:\Users\Nd9E1FYi\AppData\Roaming\glTdf2.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\gzQZ8X2.pdf
C:\Users\Nd9E1FYi\AppData\Roaming\jyO85xNjIWhPzN3XLEWX.pdf
C:\Users\Nd9E1FYi\AppData\Roaming\ryBtr_ImzJ-YH.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\tDbDdQIU.png
C:\Users\Nd9E1FYi\AppData\Roaming\tGO1g9a9iJqPbCX623Z.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\y26 ETKlKdw6lpfVFKw.swf
C:\Users\Nd9E1FYi\AppData\Roaming\zDam7i8-.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\zDeednOSIL.png
C:\Users\Nd9E1FYi\AppData\Roaming\zREI.pptx
C:\Users\Nd9E1FYi\Desktop\-9Trf.swf
C:\Users\Nd9E1FYi\Desktop\-OYX9EEQECN61L1yQ_gW.gif
C:\Users\Nd9E1FYi\Desktop\0nnsU6 3x.png
C:\Users\Nd9E1FYi\Desktop\2XyJ1n26wW.wav
C:\Users\Nd9E1FYi\Desktop\3WjcvS0eF3.doc
C:\Users\Nd9E1FYi\Desktop\6_LyGgNWJML5v2AEJ.png
C:\Users\Nd9E1FYi\Desktop\B-XOybPIj61amekbe3.flv
C:\Users\Nd9E1FYi\Desktop\DvFo5H d89.mkv
C:\Users\Nd9E1FYi\Desktop\E6nZIZA3WamUfQrFUL.gif
C:\Users\Nd9E1FYi\Desktop\F4rCHcMtVZrfr2v5T8.jpg
C:\Users\Nd9E1FYi\Desktop\FJ2E932Csl 3dAqI.mp4
C:\Users\Nd9E1FYi\Desktop\NR 8.mkv
C:\Users\Nd9E1FYi\Desktop\OVp1qTXx.swf
C:\Users\Nd9E1FYi\Desktop\UUBCzlq40tkH.png
C:\Users\Nd9E1FYi\Desktop\UV5947dYSr qot.wav
C:\Users\Nd9E1FYi\Desktop\Y4meTi4hCXo.png
C:\Users\Nd9E1FYi\Desktop\YF29-KJbSCujkqsZAW.swf
C:\Users\Nd9E1FYi\Desktop\YZpmARfkMqrB.flv
C:\Users\Nd9E1FYi\Desktop\ZYAwreiSBmoB3.m4a
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\6rUHj6tCh.m4a
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\72A4BmkLK9E3Heyb8.png
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\CWgK.mkv
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\HmVveniF.pptx
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\Mp-8N5x68OKnFvCt.jpg
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\b05fSzf.avi
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\bUJ0KF2tCfb4.gif
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\dV4QA0rRqFciDA.jpg
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\eBVbwf.wav
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\jw-z1etq3vB.ots
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\k_jvpvCHGUb.wav
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\sGztOGZPeR-GT.png
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\z2D3.jpg
C:\Users\Nd9E1FYi\Desktop\ZuQl3WrM7.mkv
C:\Users\Nd9E1FYi\Desktop\_jezKEm.mp3
C:\Users\Nd9E1FYi\Desktop\dhL6Fu-g.mp3
C:\Users\Nd9E1FYi\Desktop\fhwL5vFV76L.mp4
C:\Users\Nd9E1FYi\Desktop\jM106hnpo0Mp1.png
C:\Users\Nd9E1FYi\Desktop\l1zghqcaxoTfetjemk.wav
C:\Users\Nd9E1FYi\Desktop\mMtBJeIL7x.ppt
C:\Users\Nd9E1FYi\Desktop\n58o0SLdjiJrq_.jpg
C:\Users\Nd9E1FYi\Desktop\rlavyAN6BKLDxr.gif
C:\Users\Nd9E1FYi\Desktop\vGYXq7_nn2Xdyc.pdf
C:\Users\Nd9E1FYi\Desktop\wr25.m4a
C:\Users\Nd9E1FYi\Desktop\x4sfgnh6.avi
C:\Users\Nd9E1FYi\Desktop\z4JD0cF.jpg
C:\Users\Nd9E1FYi\Desktop\zSxORLyxk2WPTyHJ.wav
C:\Users\Nd9E1FYi\Documents\-w4Z.pptx
C:\Users\Nd9E1FYi\Documents\0jasXOqUwZJ.docx
C:\Users\Nd9E1FYi\Documents\1xVvP8J5QD58Br.pptx
C:\Users\Nd9E1FYi\Documents\3yTs1g3y1b3T82jbZ.docx
C:\Users\Nd9E1FYi\Documents\44kQq.xlsx
C:\Users\Nd9E1FYi\Documents\5SEl7yNJfNf 7.xlsx
C:\Users\Nd9E1FYi\Documents\5Vp2zNMQw.docx
C:\Users\Nd9E1FYi\Documents\7LpdMtkosdHoWkd.pptx
C:\Users\Nd9E1FYi\Documents\7PwL.pptx
C:\Users\Nd9E1FYi\Documents\7gAX BXMTy_on P.xlsx
C:\Users\Nd9E1FYi\Documents\8EleCa0h.pptx
C:\Users\Nd9E1FYi\Documents\8JWky26g.pptx
C:\Users\Nd9E1FYi\Documents\8ze3BvalytNgJ0.doc
C:\Users\Nd9E1FYi\Documents\Auv9TkhK4AVcEM1snR6.xlsx
C:\Users\Nd9E1FYi\Documents\BMYvd7i.docx
C:\Users\Nd9E1FYi\Documents\Bx2dghVSc15JQ.pptx
C:\Users\Nd9E1FYi\Documents\Byce0.ots
C:\Users\Nd9E1FYi\Documents\C8cawMZIhls6wnpfX7.xlsx
C:\Users\Nd9E1FYi\Documents\DT9y-MMc7v7TSzc7.xls
C:\Users\Nd9E1FYi\Documents\ErxL_Fctc.pptx
C:\Users\Nd9E1FYi\Documents\ExP5d.docx
C:\Users\Nd9E1FYi\Documents\F1 9mS42.xlsx
C:\Users\Nd9E1FYi\Documents\F8JI33ipP6.xlsx
C:\Users\Nd9E1FYi\Documents\FS1i-2xsN.xlsx
C:\Users\Nd9E1FYi\Documents\FV2C8uSQJnEC82 KB.xlsx
C:\Users\Nd9E1FYi\Documents\GnpUk.pptx
C:\Users\Nd9E1FYi\Documents\I5KYDRFKLmRe.docx
C:\Users\Nd9E1FYi\Documents\IyFSxGm63ipj8Fi.docx
C:\Users\Nd9E1FYi\Documents\K16 iK_pnuIi2Y.docx
C:\Users\Nd9E1FYi\Documents\NqmH-s4P.pptx
C:\Users\Nd9E1FYi\Documents\NwEgm fkgFylD3AmQj--.xlsx
C:\Users\Nd9E1FYi\Documents\OGy4o1.xlsx
C:\Users\Nd9E1FYi\Documents\PM2dnrAW XSnb59p.pptx
C:\Users\Nd9E1FYi\Documents\S-Ew.docx
C:\Users\Nd9E1FYi\Documents\TBKBM6xdJVb3EfdCQC.docx
C:\Users\Nd9E1FYi\Documents\UOfFU40gTf6N9bJP.xlsx
C:\Users\Nd9E1FYi\Documents\VlmSD.xlsx
C:\Users\Nd9E1FYi\Documents\YF7U-RLlv_S-sJHB0.pptx
C:\Users\Nd9E1FYi\Documents\YZmissvlme--GI.ods
C:\Users\Nd9E1FYi\Documents\YtODKee6X7FObc.pdf
C:\Users\Nd9E1FYi\Documents\bQpCsm9XED akG.docx
C:\Users\Nd9E1FYi\Documents\bpQ_iePFAsJw.pptx
C:\Users\Nd9E1FYi\Documents\cDeaa0w.docx
C:\Users\Nd9E1FYi\Documents\cPMmF.docx
C:\Users\Nd9E1FYi\Documents\eamZqrO2R1DQ.pptx
C:\Users\Nd9E1FYi\Documents\gQFzMLqSn59ww7it2lYz.pptx
C:\Users\Nd9E1FYi\Documents\hAFLGvRvH7.docx
C:\Users\Nd9E1FYi\Documents\hAh ZaAd64laSsE.pptx
C:\Users\Nd9E1FYi\Documents\hEfGd_.docx
C:\Users\Nd9E1FYi\Documents\hay272u52KVmziq.xlsx
C:\Users\Nd9E1FYi\Documents\iQZWtnEmp60cCuHkvip.pptx
C:\Users\Nd9E1FYi\Documents\iuI_7E.docx
C:\Users\Nd9E1FYi\Documents\jXLz4BcRLq1WA.xlsx
C:\Users\Nd9E1FYi\Documents\jbMuEIJRUe.docx
C:\Users\Nd9E1FYi\Documents\l4g4BpknN_RZ5eTgTZrV.xlsx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\2zEQXHuWB18v-.pdf
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\3JiAXE-Dvg9u4wthKp1.odp
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\4_hu.csv
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\5d5Wt0rB.docx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\BxPFetzC90cfA.pps
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\FbDbpIpR_FrukJKVHB.doc
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\FnlUsEaMGxDGuOh.ots
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\QOPzrF-O.ots
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\WwndQdhCd5EDQtS.pdf
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\ZgJEvDc8GkxO_bIa.ods
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\a35Vhov3AU scg0Gd4.odp
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\akk0fiybc.xlsx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\eYl-8DG.xlsx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\mBx6uPx7SB0eVq8ZE3O.csv
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\wOIu9pf8.xlsx
C:\Users\Nd9E1FYi\Documents\mXPe7LYwuV9k-.odt
C:\Users\Nd9E1FYi\Documents\mf3xZjmJ27kK7R3PU.pdf
C:\Users\Nd9E1FYi\Documents\mkm7NUkVx3Pm6ey.doc
C:\Users\Nd9E1FYi\Documents\nn-IByv.pptx
C:\Users\Nd9E1FYi\Documents\oIII3s6-o3wx-lYprR8.xlsx
C:\Users\Nd9E1FYi\Documents\oIzGCEZnPe-a.pptx
C:\Users\Nd9E1FYi\Documents\oVos_5ivVjnJb.xlsx
C:\Users\Nd9E1FYi\Documents\pNnGlg0JGp7ittSAi FW.csv
C:\Users\Nd9E1FYi\Documents\pzYcRljzhGaVd.docx
C:\Users\Nd9E1FYi\Documents\rOKrZwVBYUxm9DMUa.pptx
C:\Users\Nd9E1FYi\Documents\rwNyJ1z c-E.docx
C:\Users\Nd9E1FYi\Documents\sK zJHIeJAR.pptx
C:\Users\Nd9E1FYi\Documents\v32sY7rMc.xlsx
C:\Users\Nd9E1FYi\Documents\wGVa.xlsx
C:\Users\Nd9E1FYi\Documents\wLDWdZSYmzRQ6Zzoq.pptx
C:\Users\Nd9E1FYi\Documents\xJwClQ7_bmGagM6rZ84s.docx
C:\Users\Nd9E1FYi\Documents\xrXT-v7yaice5H2T.pptx
C:\Users\Nd9E1FYi\Music\BnGUzS ja.m4a
C:\Users\Nd9E1FYi\Music\C_bQN2zVMN0mQ.wav
C:\Users\Nd9E1FYi\Music\Ge_YfxFBPHmlr.mp3
C:\Users\Nd9E1FYi\Music\HUJYV4bpvjfW_CS6Y7qM.wav
C:\Users\Nd9E1FYi\Music\Hwll8oc.mp3
C:\Users\Nd9E1FYi\Music\IPaRcXitJ3.wav
C:\Users\Nd9E1FYi\Music\VFb46v3OjJywtgg.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\Msg9Nf45z.wav
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\Q7vYpJMqhuL.mp3
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\XdzDP8q25Vz CZLm.wav
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\Xg3hy1auA VtJ.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\bO 5.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\jfian_u9 qPSU.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\jysR.wav
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\uvAqtWa_xDxz4W.mp3
C:\Users\Nd9E1FYi\Music\hbpy.wav
C:\Users\Nd9E1FYi\Music\iRp3XvDwnMzhq7Tph.m4a
C:\Users\Nd9E1FYi\Music\pG60.m4a
C:\Users\Nd9E1FYi\Music\xCs0cAQI.wav
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\67DBSEJ4BMZoo.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\9hx4KltHzwaV96eWM7m.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\J3xY.mp3
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\JbyIDPua.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\Riiyc.wav
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\ed9xd5h-2gIGAMMRx.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\fO0jUWY20lwF4-tkPpDy.wav
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\kc1rJ3AmL0bAH2.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\oU0oJhKYwfkG.mp3
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\skofRHUf9.wav
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\G_VX1o.png
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\ahss.jpg
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\g4rNKN5n8p.jpg
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\lOBaZ7mU2Cce7Pt 6UPd.bmp
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\sijWeDuP.jpg
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\xr3EZlrsZI83yt_kWu2.png
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\yuu nzR1J5HR.gif
C:\Users\Nd9E1FYi\Pictures\R pocsiOj-Noc_UJ
C:\Users\Nd9E1FYi\Pictures\R pocsiOj-Noc_UJ\B1J4ZvBs7Wnw.bmp
C:\Users\Nd9E1FYi\Pictures\R pocsiOj-Noc_UJ\VpvEpX7uKz2G.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\5HCHzFiu.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\BpgiceQ9WSR-wV.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\CYB3ALTRf kkHXAUjv.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\80XWeeA-OkvHp6t0DdgT.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\CZ3ODbncGDB.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\RC7q6ya8K2F.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\bRdboP8JZofbuP1oQ.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\xbEDb3t2WV1m rm.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\N3bKwo IiWo.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\QUfOoQudq5ii_wCW3.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\TIpbZsRVl1tyKIlDnofS.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\fsLYBH3B.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\h2CjEax2s R4.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\wsbNjomrrUiKMLM2.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\O7IW Th4-RysY0CoQ.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\UlB6szohpLtW0I.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\r2q91y63Ga3lOrxq4.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\vcmpruQhTyQ.gif
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\xBiYGqKPS7CGTRAfT.bmp
C:\Users\Nd9E1FYi\Pictures\v0c0LRwMUG.png
C:\Users\Nd9E1FYi\Videos\5E4po1Toia47cL.avi
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\-zXXD.swf
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\W1SqyZC79Zk0cdIYEsL.avi
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\dl1wIih1Fb.avi
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\lc6YKaTk.mp4
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\piNaQi.mp4
C:\Users\Nd9E1FYi\Videos\CbpZhe6J.avi
C:\Users\Nd9E1FYi\Videos\_kIfbJ Ajj5JPTOsZS.mp4
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\89E5Wqz.swf
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\C1UnGMo1MAV6S GGH P.mp4
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\OeA4fzH8q8e.flv
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\Z4b0MlWeheQcknS.mp4
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\mrWuVDH8p.mkv
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\vuynfRjXmLvWSF54.avi
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\wlkRiMxe.flv
C:\Users\Nd9E1FYi\Videos\i2M-KX.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\4z rRuj6jH3RlDbDeHiC.flv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\7xUhVhF1E9l_.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\894rkdBTDbCdD n.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\BCpV3I5plzD64fPa5S.swf
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\FomvQAmQ01NetI-.mkv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\PfBs A.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\UORmAJ4MrpoHL_P.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\_qyy_L5cd4eBwclSvVO.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\d1kmtw_-4m8GXeCZU1E2.mkv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\fHxT4TCOfw5y _zpcC.flv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\jDJq2x.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\o-9E0ZdKYO2a.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\ryA59W2_kDpU3gWzH1U.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\wtr4vSqW9H3G.swf
C:\Users\Nd9E1FYi\Videos\kN3yN_HbUU.flv
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou\152 T56dJsjX30Bev.flv
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou\CVIliyOoXGUc-BWT8Olv.swf
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou\xd3 C6qv.flv
C:\Users\Nd9E1FYi\Videos\pmjIPvL38n_s bVO.swf
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image