RTF drops file to XLSTART | Environment
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Spyware

83b0d7926fb2c5bc0708d9201043107e8709d77f2cd2fb5cb7693b2d930378d2 (SHA256)

Invitation CBS 2018 .doc.rtf

RTF Document

Created at 2018-08-05 19:04:00

Virtual Machine Information

Name win10_64
Description Windows 10 (64-bit), MS Office 2016 (64-bit)
Architecture x86 64-bit
Operating System Windows 10 Threshold 2
Kernel Version 10.0.10586.0 (0de6dc23-8e19-4bb7-8608-d54b1e6fa379)

System Information

Computer Name X2VS1CUM
User Domain X2VS1CUM
User Name Nd9E1FYi
User Profile C:\Users\Nd9E1FYi
Temp Directory C:\Users\Nd9E1FYi\AppData\Local\Temp
System Root C:\Windows
Sample Directory C:\Users\Nd9E1FYi\Desktop

Software Information

Adobe Acrobat Reader Version 15.007.20033
Microsoft Office 2016
Microsoft Office Version 16.0.4266.1001
Internet Explorer Version 11.0.10586.0
Chrome Version 60.0.3112.113
Firefox Version 55.0.2
Flash Version 25.0.0.148
Java Version 8.0.1440.1

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (18)
»
Filename PID GUI
C:\Program Files (x86)\Adobe\control.exe #3656 False
C:\Program Files (x86)\Adobe\florence.exe #3952 False
C:\Program Files (x86)\Common Files\chargesvastfrozen.exe #4012 False
C:\Program Files (x86)\MSBuild\system.exe #2572 False
C:\Program Files (x86)\MSBuild\watershed.exe #3520 False
C:\Program Files (x86)\MSECache\reliability_cm.exe #3800 False
C:\Program Files (x86)\Microsoft Office\surfaces-attractions.exe #3972 False
C:\Program Files (x86)\Windows Defender\announced cambridge draw.exe #3696 False
C:\Program Files (x86)\WindowsPowerShell\existence.exe #3844 False
C:\Program Files\Internet Explorer\would.exe #3864 False
C:\Program Files\MSBuild\beastinstall.exe #3552 False
C:\Program Files\Microsoft Office\attempting mason.exe #3824 False
C:\Program Files\Microsoft Office\previously.exe #3992 False
C:\Program Files\Uninstall Information\lower.exe #2928 False
C:\Program Files\Windows Multimedia Platform\faith margin nov.exe #4028 False
C:\Program Files\Windows Portable Devices\into_solely_magazine.exe #3680 False
C:\Program Files\Windows Portable Devices\strengthening_law.exe #3932 False
C:\Program Files\Windows Portable Devices\velvet.exe #3772 False
Files (308)
»
Filename
C:\Users\Nd9E1FYi\AppData\Local\Temp\-DKDQDU0tuMSdB02zUKj.jpg
C:\Users\Nd9E1FYi\AppData\Local\Temp\2EksDuG.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\302dj.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\3FkmE2Au Mv l2BtXWw.mp3
C:\Users\Nd9E1FYi\AppData\Local\Temp\42dKKuJnqOK.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\56ocv.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\5VXon2dVX2kApSa1WA_U.mkv
C:\Users\Nd9E1FYi\AppData\Local\Temp\7 yc1T8PEK_.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\8EVIe.xls
C:\Users\Nd9E1FYi\AppData\Local\Temp\A-j7o6o2NVW6i.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\EMX-ivJ.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\FlKZewvqKCTSvZn.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\GPJw.rtf
C:\Users\Nd9E1FYi\AppData\Local\Temp\GqDzisSK54YZFJn7.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\HGr_8nmYIl.jpg
C:\Users\Nd9E1FYi\AppData\Local\Temp\IbHJ4g_HJRLG7Qio0yMg.png
C:\Users\Nd9E1FYi\AppData\Local\Temp\IvxbvVSY7yGiWGH.jpg
C:\Users\Nd9E1FYi\AppData\Local\Temp\M 0-b2MJxzKO9V2.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\TmymI-R.docx
C:\Users\Nd9E1FYi\AppData\Local\Temp\aujfPvVdIE.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\bJc7fAp00NeHFrONGiF.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\cuzjrEC.ots
C:\Users\Nd9E1FYi\AppData\Local\Temp\e4o4br7zd2oQG-YC2G6.ods
C:\Users\Nd9E1FYi\AppData\Local\Temp\irSZv.ppt
C:\Users\Nd9E1FYi\AppData\Local\Temp\jEsDv qmFE42yRk5btO.rtf
C:\Users\Nd9E1FYi\AppData\Local\Temp\rMysFjsu.docx
C:\Users\Nd9E1FYi\AppData\Local\Temp\u9MWe8.bmp
C:\Users\Nd9E1FYi\AppData\Local\Temp\v0IgIvN2UEBEZK3u_.ppt
C:\Users\Nd9E1FYi\AppData\Local\Temp\ycSTl_NJ.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\z6lbgmpCLIM5OhSU7r.mkv
C:\Users\Nd9E1FYi\AppData\Roaming\20Gb6pW0 qh9z.docx
C:\Users\Nd9E1FYi\AppData\Roaming\2B6Peji.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\4qe2kLU4tslmjRM.avi
C:\Users\Nd9E1FYi\AppData\Roaming\6net_05IlzjJtdE.gif
C:\Users\Nd9E1FYi\AppData\Roaming\7DIWCVKqo.ods
C:\Users\Nd9E1FYi\AppData\Roaming\C4PfpanK85HZA4Smr.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\CHRQ.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\EqorYS.png
C:\Users\Nd9E1FYi\AppData\Roaming\L9KR9jJXkHw8.swf
C:\Users\Nd9E1FYi\AppData\Roaming\LUTj-uW.avi
C:\Users\Nd9E1FYi\AppData\Roaming\M35NqNA_5puo3.pps
C:\Users\Nd9E1FYi\AppData\Roaming\M7 PniIUpcqL.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\NBI v5.ots
C:\Users\Nd9E1FYi\AppData\Roaming\PvL4nb.wav
C:\Users\Nd9E1FYi\AppData\Roaming\S8B0WbwcTq6X-A EeTC.pdf
C:\Users\Nd9E1FYi\AppData\Roaming\TS1G44.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\U-7FQdCJa12OWXDOXlZ_.odt
C:\Users\Nd9E1FYi\AppData\Roaming\UA59lsU6hyKs5.flv
C:\Users\Nd9E1FYi\AppData\Roaming\UbkN19cpNaowq2r.flv
C:\Users\Nd9E1FYi\AppData\Roaming\VIEEl9VUhlV w.pps
C:\Users\Nd9E1FYi\AppData\Roaming\X8PZ.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\YA0Zgmb9YSRQoXBedq.gif
C:\Users\Nd9E1FYi\AppData\Roaming\ZCOcSBK.csv
C:\Users\Nd9E1FYi\AppData\Roaming\g_agCQutZoeLZx.png
C:\Users\Nd9E1FYi\AppData\Roaming\iCeux27Eu_Lgl3l9w.avi
C:\Users\Nd9E1FYi\AppData\Roaming\iNysEbqTrGr.wav
C:\Users\Nd9E1FYi\AppData\Roaming\iP_SU4oGpii-9it.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\kd25spw10dDKKcktFwAl.odt
C:\Users\Nd9E1FYi\AppData\Roaming\nOIhRnA1-YA09.mp4
C:\Users\Nd9E1FYi\AppData\Roaming\p3Mg-s.swf
C:\Users\Nd9E1FYi\AppData\Roaming\qjgV48ICMO.swf
C:\Users\Nd9E1FYi\AppData\Roaming\rFpUpWbIYANw9W.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\tXAr1N.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\tYz1o20b99L9QyOP4t.gif
C:\Users\Nd9E1FYi\AppData\Roaming\uJapVr-IXSfJ.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\ufqd6SiW7F4aiuefm8T.pdf
C:\Users\Nd9E1FYi\AppData\Roaming\vD8J9awV.odp
C:\Users\Nd9E1FYi\AppData\Roaming\xVr7gyuMuo.docx
C:\Users\Nd9E1FYi\AppData\Roaming\yehzf.jpg
C:\Users\Nd9E1FYi\Desktop\-HjY-kf7f4gVhlLs.avi
C:\Users\Nd9E1FYi\Desktop\1s2Cx1msP.wav
C:\Users\Nd9E1FYi\Desktop\2V4V0wSyN WB.wav
C:\Users\Nd9E1FYi\Desktop\4BiMi3I4bwJqBHplV.avi
C:\Users\Nd9E1FYi\Desktop\8dqy9P8R.wav
C:\Users\Nd9E1FYi\Desktop\8y_chApkZe.ppt
C:\Users\Nd9E1FYi\Desktop\9hUFGNBqdha 2Nj4KW8.mp4
C:\Users\Nd9E1FYi\Desktop\Cfhf1G9-odI_Ax6G.jpg
C:\Users\Nd9E1FYi\Desktop\DOHYS115-M.jpg
C:\Users\Nd9E1FYi\Desktop\EQZGkenTndR.jpg
C:\Users\Nd9E1FYi\Desktop\Ebxg9 2q5b6JQd7.bmp
C:\Users\Nd9E1FYi\Desktop\G7K0.flv
C:\Users\Nd9E1FYi\Desktop\JeeHH4mRydEPMACM_Eha.doc
C:\Users\Nd9E1FYi\Desktop\LRfo8kgTXb0PBtzK7N.flv
C:\Users\Nd9E1FYi\Desktop\LhN36x.avi
C:\Users\Nd9E1FYi\Desktop\NBHiw.mkv
C:\Users\Nd9E1FYi\Desktop\OuNVXcxjI.wav
C:\Users\Nd9E1FYi\Desktop\SBUSPMQx6oE.rtf
C:\Users\Nd9E1FYi\Desktop\U 1G0gIasHabuYld.odp
C:\Users\Nd9E1FYi\Desktop\VHdGMrPCexZv.mp4
C:\Users\Nd9E1FYi\Desktop\ZHahvfRHLKhS.mp3
C:\Users\Nd9E1FYi\Desktop\_-H-2PP453khqwZTiYd.jpg
C:\Users\Nd9E1FYi\Desktop\_YLGLpld_WUv5.m4a
C:\Users\Nd9E1FYi\Desktop\aHH99JUOMKNb8Yz3Kw7.pdf
C:\Users\Nd9E1FYi\Desktop\bGStQR2b5zW.flv
C:\Users\Nd9E1FYi\Desktop\eVM-L.m4a
C:\Users\Nd9E1FYi\Desktop\fJLzhJHw LeX_y.mkv
C:\Users\Nd9E1FYi\Desktop\frzdIL7OvwDF2.m4a
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\48w2k1.flv
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\I2eyTD_tYD8_BKfj.m4a
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\N5IKfeNG.mp4
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\PXnzkoKBjIw7FCiZ.swf
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\Y0DPh7WOLp.mkv
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\h_2NLQ64Fa0y_s.png
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\rwI45qNVUh.xlsx
C:\Users\Nd9E1FYi\Desktop\hbaAmb9I C5H\x2PZGF 4-8.mp4
C:\Users\Nd9E1FYi\Desktop\ikSm81uYSV8Wk0d3Gi.swf
C:\Users\Nd9E1FYi\Desktop\jYWMf9GwKjcImj.mp4
C:\Users\Nd9E1FYi\Desktop\nxlD3ZbF0sKkM.mp3
C:\Users\Nd9E1FYi\Desktop\pZNpaNMXKrflxy4HdfKm.swf
C:\Users\Nd9E1FYi\Desktop\qbEM230Ra4uyI8.bmp
C:\Users\Nd9E1FYi\Desktop\sXhRdZv.png
C:\Users\Nd9E1FYi\Desktop\slhyNm35wayMOeV.bmp
C:\Users\Nd9E1FYi\Desktop\xg1 4OP-M cR08yP.docx
C:\Users\Nd9E1FYi\Desktop\y6AIRwbxAW.wav
C:\Users\Nd9E1FYi\Desktop\zSgNe.m4a
C:\Users\Nd9E1FYi\Documents\0RnLQdMgL2KPIaEHYkY.odp
C:\Users\Nd9E1FYi\Documents\0YVm1OM6A6Q.pptx
C:\Users\Nd9E1FYi\Documents\1d2jM1AORI3ku.xlsx
C:\Users\Nd9E1FYi\Documents\1w sGvKcbteB.docx
C:\Users\Nd9E1FYi\Documents\3KnJg05.pptx
C:\Users\Nd9E1FYi\Documents\3j5DH7zmf15btVppO.pptx
C:\Users\Nd9E1FYi\Documents\4cgdxeMlcX3lcfxSA.odt
C:\Users\Nd9E1FYi\Documents\5jbzI_u9.pptx
C:\Users\Nd9E1FYi\Documents\5qnCm V0LQoY.xlsx
C:\Users\Nd9E1FYi\Documents\61AAB.pptx
C:\Users\Nd9E1FYi\Documents\7f5G5mbnGD116.pptx
C:\Users\Nd9E1FYi\Documents\9tST16EZRXcZuUA6S.xlsx
C:\Users\Nd9E1FYi\Documents\BW7HTaO4 VghgMAnBUs.xlsx
C:\Users\Nd9E1FYi\Documents\Bzg a.rtf
C:\Users\Nd9E1FYi\Documents\CxOv1An-w7qom.pptx
C:\Users\Nd9E1FYi\Documents\D7mLp6WfN.xlsx
C:\Users\Nd9E1FYi\Documents\F mhdTJwOJLKZxn.docx
C:\Users\Nd9E1FYi\Documents\F3T5B.xlsx
C:\Users\Nd9E1FYi\Documents\FpN3qEOhQ.docx
C:\Users\Nd9E1FYi\Documents\HbSfgLUhCMkO.xlsx
C:\Users\Nd9E1FYi\Documents\HcqTMG68Hx.xlsx
C:\Users\Nd9E1FYi\Documents\HzUPC38.pptx
C:\Users\Nd9E1FYi\Documents\IPoUmoGPLo7N0.pptx
C:\Users\Nd9E1FYi\Documents\IqlxUCmAJrc.pptx
C:\Users\Nd9E1FYi\Documents\JFTm-fZA5zn-.docx
C:\Users\Nd9E1FYi\Documents\KrWFT5R.pptx
C:\Users\Nd9E1FYi\Documents\KvKMS.docx
C:\Users\Nd9E1FYi\Documents\LldToHClhQUFDN4HV.docx
C:\Users\Nd9E1FYi\Documents\NFwbhAgVe11LnAhqTPW.docx
C:\Users\Nd9E1FYi\Documents\Ng5KO3Zst7rVvDw.docx
C:\Users\Nd9E1FYi\Documents\P7K-gQ.ods
C:\Users\Nd9E1FYi\Documents\PY3mrxI9XVZxryTLSn-.pptx
C:\Users\Nd9E1FYi\Documents\PmXVEWaLJz4jquRS0g.pptx
C:\Users\Nd9E1FYi\Documents\SKzh.xlsx
C:\Users\Nd9E1FYi\Documents\SWDWZ.docx
C:\Users\Nd9E1FYi\Documents\U43YOtYS-qlbY1zQl1.ots
C:\Users\Nd9E1FYi\Documents\UoDwZ_7dZ.xlsx
C:\Users\Nd9E1FYi\Documents\WC58aij.xlsx
C:\Users\Nd9E1FYi\Documents\WWpFxZGn8.xlsx
C:\Users\Nd9E1FYi\Documents\Wacnmh8WoAV30.docx
C:\Users\Nd9E1FYi\Documents\XkbyjrKv62.docx
C:\Users\Nd9E1FYi\Documents\ZN9eM7
C:\Users\Nd9E1FYi\Documents\ZN9eM7\1i4DMULCtgzMVjY.odt
C:\Users\Nd9E1FYi\Documents\ZN9eM7\2YhKgwZCj7gRF5QN oO5.doc
C:\Users\Nd9E1FYi\Documents\ZN9eM7\2ttA3Gb4LpIpZRsC53y.rtf
C:\Users\Nd9E1FYi\Documents\ZN9eM7\2wRf1.odp
C:\Users\Nd9E1FYi\Documents\ZN9eM7\J4erSRgGM_OqV0Z0uRG.pptx
C:\Users\Nd9E1FYi\Documents\ZN9eM7\LEhJuNb7FJnecDKkJS.csv
C:\Users\Nd9E1FYi\Documents\ZN9eM7\MWzr1yZmiXASB1b.xlsx
C:\Users\Nd9E1FYi\Documents\ZN9eM7\SADs8I.pdf
C:\Users\Nd9E1FYi\Documents\ZN9eM7\Tv5JF12wuyvm9dl.ods
C:\Users\Nd9E1FYi\Documents\ZN9eM7\X_6fnbgHdd aZFX.rtf
C:\Users\Nd9E1FYi\Documents\ZN9eM7\gOX9.ots
C:\Users\Nd9E1FYi\Documents\ZN9eM7\jYuBU.ppt
C:\Users\Nd9E1FYi\Documents\ZN9eM7\l4HYJ.csv
C:\Users\Nd9E1FYi\Documents\ZN9eM7\mmJEJvzIOmWvC2.docx
C:\Users\Nd9E1FYi\Documents\ZRkiQkmM.xlsx
C:\Users\Nd9E1FYi\Documents\_DUYISXK.docx
C:\Users\Nd9E1FYi\Documents\blxV.docx
C:\Users\Nd9E1FYi\Documents\cdzROPbmggeoaeyL02A.pptx
C:\Users\Nd9E1FYi\Documents\d4sd7gh935sXZEmRGS.xlsx
C:\Users\Nd9E1FYi\Documents\d637zxcYItN3iM96w nG.xlsx
C:\Users\Nd9E1FYi\Documents\eVhI9wA-Rv0Z3.odp
C:\Users\Nd9E1FYi\Documents\gnKT.xlsx
C:\Users\Nd9E1FYi\Documents\hZJd94ck0uYY6oI.docx
C:\Users\Nd9E1FYi\Documents\i8e83chM.pptx
C:\Users\Nd9E1FYi\Documents\iEQ95 yNxFBfnfQIj.xlsx
C:\Users\Nd9E1FYi\Documents\iIIbwAMIzWDIp-vVaDY.docx
C:\Users\Nd9E1FYi\Documents\j4QNAONXlQgpy.pdf
C:\Users\Nd9E1FYi\Documents\jMcm9kQ.pptx
C:\Users\Nd9E1FYi\Documents\jotDsPOloFrB.docx
C:\Users\Nd9E1FYi\Documents\kAS6pI-Os-k.odp
C:\Users\Nd9E1FYi\Documents\k_ri97.pptx
C:\Users\Nd9E1FYi\Documents\lO77vCrLA4RKZN.xlsx
C:\Users\Nd9E1FYi\Documents\lYbrCAmnxyWyNC-H.pptx
C:\Users\Nd9E1FYi\Documents\lZTA2DzV1ZD.docx
C:\Users\Nd9E1FYi\Documents\nPN30.xlsx
C:\Users\Nd9E1FYi\Documents\nt30vGn0m2S.docx
C:\Users\Nd9E1FYi\Documents\pI1t.xlsx
C:\Users\Nd9E1FYi\Documents\qiBVuFY7kg_.pptx
C:\Users\Nd9E1FYi\Documents\r6rIYtJM0GQIxkhpfsmq.rtf
C:\Users\Nd9E1FYi\Documents\rIm GriPy3KC0jP SslN.xlsx
C:\Users\Nd9E1FYi\Documents\sXA0b genSGr3W.xlsx
C:\Users\Nd9E1FYi\Documents\slhz6Q5xnVK5fcJ.docx
C:\Users\Nd9E1FYi\Documents\vGxgvnI1Ua6w3cOaI.docx
C:\Users\Nd9E1FYi\Documents\wgp3B.pptx
C:\Users\Nd9E1FYi\Documents\whEYIV1KW15Y0Xk.ppt
C:\Users\Nd9E1FYi\Documents\wqEKYF-t50KVFrtU6.docx
C:\Users\Nd9E1FYi\Music\B87nOq7snMo.mp3
C:\Users\Nd9E1FYi\Music\EcRNnV.m4a
C:\Users\Nd9E1FYi\Music\Irx-MRfDHvkLbi5Jz.wav
C:\Users\Nd9E1FYi\Music\PByxBcn.m4a
C:\Users\Nd9E1FYi\Music\QMMiNUs.mp3
C:\Users\Nd9E1FYi\Music\SNTHO5 lHbTF.wav
C:\Users\Nd9E1FYi\Music\ZTI2hmeyUQVIO.m4a
C:\Users\Nd9E1FYi\Music\lVGo
C:\Users\Nd9E1FYi\Music\lVGo\D47nJw MN.mp3
C:\Users\Nd9E1FYi\Music\lVGo\GK1A.mp3
C:\Users\Nd9E1FYi\Music\lVGo\Hz_HVWBNE5RSZbYhdXL.m4a
C:\Users\Nd9E1FYi\Music\lVGo\I79w ikzYtdGNkn.m4a
C:\Users\Nd9E1FYi\Music\lVGo\KeKuw f5X8BhNfdCy.wav
C:\Users\Nd9E1FYi\Music\lVGo\KlgT2e2mht.m4a
C:\Users\Nd9E1FYi\Music\lVGo\L3rwhst.m4a
C:\Users\Nd9E1FYi\Music\lVGo\gvCPyuc7.mp3
C:\Users\Nd9E1FYi\Music\lVGo\jnrX.mp3
C:\Users\Nd9E1FYi\Music\lVGo\rPwvPoqKL2V8sO9fH.wav
C:\Users\Nd9E1FYi\Music\lVGo\y5VKIgFPiNZ3vvwvjVO.m4a
C:\Users\Nd9E1FYi\Music\tOFi1Ky.wav
C:\Users\Nd9E1FYi\Music\uta_.m4a
C:\Users\Nd9E1FYi\Music\vYl __hMb_hrrBghkBhA.mp3
C:\Users\Nd9E1FYi\Music\wo4CWWrGs3G1gDz.m4a
C:\Users\Nd9E1FYi\Music\xJBYYlq0b.m4a
C:\Users\Nd9E1FYi\Music\xd9e8QV-E1PVW 5_T
C:\Users\Nd9E1FYi\Music\xd9e8QV-E1PVW 5_T\RD81F9J6aMeYLlGfvnNi.wav
C:\Users\Nd9E1FYi\Music\xd9e8QV-E1PVW 5_T\RKzR_n3 Bfg.wav
C:\Users\Nd9E1FYi\Music\xd9e8QV-E1PVW 5_T\bfySk5U.m4a
C:\Users\Nd9E1FYi\Music\xd9e8QV-E1PVW 5_T\tZvbqMFw.wav
C:\Users\Nd9E1FYi\Music\yUrVdh0bs.wav
C:\Users\Nd9E1FYi\Music\z5C058O2R1c7.mp3
C:\Users\Nd9E1FYi\Pictures\-ZhB.jpg
C:\Users\Nd9E1FYi\Pictures\3V8ZXZ1ksv.gif
C:\Users\Nd9E1FYi\Pictures\6oM0zZjtg0z0wvZuTbOy.jpg
C:\Users\Nd9E1FYi\Pictures\F94mB.bmp
C:\Users\Nd9E1FYi\Pictures\QHufbImtmpfmxtEoP-t.png
C:\Users\Nd9E1FYi\Pictures\carqV.gif
C:\Users\Nd9E1FYi\Pictures\iL _Ai 6GbVdI7tJd.jpg
C:\Users\Nd9E1FYi\Pictures\pRfPWAQ.bmp
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\FHxtozB.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\G6 K5niAavrAcI_d tSv.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Y8S0A0733H6Zei.bmp
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\0kdNFW6PdUY.jpg
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\6_PTV.jpg
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo\2qvvFMA 8.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo\4Xngta.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo\Cagw-M5aXBMm.gif
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo\ZYXB0oxPuI3u QrJqIbW.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo\ipEpHJo68B8Dze.jpg
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo\plYpI.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\7-gL9 VuSlo\zh3umZ-jBF.gif
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\CjfpSr.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\ONM50O\Xd3RDkkY0OC.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\Yd5oecaJ\cbOGxqvZtqJ.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\arxwOYBP92 g_7 NlT3t.jpg
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\bX-GE-878q7
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\bX-GE-878q7\9Wcn En4mf.jpg
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\bX-GE-878q7\bsdX68bo9aoI2vBuqcZv.bmp
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\bX-GE-878q7\kDomPhamekB0YN.jpg
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\gIJnFzHkZ3u.png
C:\Users\Nd9E1FYi\Pictures\wTsAAVb3RviWT_BTjQ27\oczAcIL5qFbBR.gif
C:\Users\Nd9E1FYi\Videos\7J-z7blC-Bp9P-BDN.flv
C:\Users\Nd9E1FYi\Videos\AU3mBciyArC.avi
C:\Users\Nd9E1FYi\Videos\EbclXPboXYls-PwnMDO.mp4
C:\Users\Nd9E1FYi\Videos\W-cNJVBTHibar.mkv
C:\Users\Nd9E1FYi\Videos\XuGtTt.mp4
C:\Users\Nd9E1FYi\Videos\c6N4SG61Q.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\496pr3a9J.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\67uL9HXx9C_dRnq.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\R6hTBSzvKUiBswYYj s.flv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\Sggzdk nf.mkv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\2D8kJRA1vCkI.swf
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\67Su36ge1z6I2Y.swf
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\7GWudL-w2-1Ry00V6dF.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\8etd8GGLye SI.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\CSBeQSRMOXX2T_.swf
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\OSnIK.mp4
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\PmjEI0g-Jg.mp4
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\U6JbIiCAtM\gSioT2X_BF.flv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\Uw75r3.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\_df9GfK03.mkv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\In5VwU.swf
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\NA70RafEnF Y0KDM.swf
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\Sq-CbIiBW.flv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\SvCn7.mp4
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\TN0UiNL.mkv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\V9HUjmRrIJ N.mp4
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\fN55WCcBOHbCM9p.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\jSPOZz19qYmzL
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\jSPOZz19qYmzL\4N-YIsyJMOre.mp4
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\jSPOZz19qYmzL\nSLl.swf
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\klk7nvoxy57O.avi
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\t2rQhGsKykE1.flv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\xNi eAOClL8B_CIk.mp4
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\czyUYn1DF8XgX\zmyk.flv
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\jkh_Z1vc.swf
C:\Users\Nd9E1FYi\Videos\hOeWIH65X2fmQGE8f\mBnWiRQZamcmY-xDO E.avi
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image