34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T496,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Spora.Generic Sample 401d979a5757… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 401d979a5757…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/401d979a5757f8a0eb2bb5fc9ff6a9c595f5328a8922ccba251ed2b75bbe0267","keywords":["Malicious","Ransom.Spora.Generic","malware analysis","sandbox report","threat intelligence","401d979a5757f8a0eb2bb5fc9ff6a9c595f5328a8922ccba251ed2b75bbe0267"],"about":{"@type":"SoftwareApplication","name":"eee","applicationCategory":["peexe","executable"],"identifier":"401d979a5757f8a0eb2bb5fc9ff6a9c595f5328a8922ccba251ed2b75bbe0267","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Spora.Generic","antivirusDetections":{"malicious":21,"total":29},"behavioralIndicators":{"malicious":7,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T417,"\Sessions\1\BaseNamedObjects\UACMut" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\m3275956978" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!wlztmhx!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!wlztmhx!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!wlztmhx!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\FirefoxStartupMutex" "\Sessions\1\BaseNamedObjects\Global\MozillaUpdateMutex-aeVcDEW6vlSu+PLYtSFCvWhPsG0="37:T60e,"healthreport.sqlite" has type "data" "Peacock.jpg" has type "data" "Tulips.jpg" has type "data" "recovery.js.tmp" has type "ASCII text with very long lines with no line terminators" "goog-phish-shavar.pset" has type "data" "cookies.sqlite-wal" has type "data" "goog-malware-shavar-1.cache" has type "data" "formhistory.sqlite-journal" has type "data" "Jellyfish.jpg" has type "SysEx File -" "White_Chocolate.jpg" has type "data" "Small_News.jpg" has type "data" "goog-malware-shavar-1.sbstore" has type "data" "ShadesOfBlue.jpg" has type "data" "goog-phish-shavar-1.sbstore" has type "data" "US359-19ZTZ-TZTXF-THZTZ.html" has type "HTML document UTF-8 Unicode (with BOM) text with very long lines with no line terminators" "Windows.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon ctime=Mon Jan 1 00:06:32 1601 mtime=Mon Jan 1 00:06:32 1601 atime=Mon Jan 1 00:06:32 1601 length=0 window=hidenormalshowminimized" "PerfLogs.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon ctime=Mon Jan 1 00:06:32 1601 mtime=Mon Jan 1 00:06:32 1601 atime=Mon Jan 1 00:06:32 1601 length=0 window=hidenormalshowminimized" "Hydrangeas.jpg" has type "data" "update.mar" has type "data" "eaEn8.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon ctime=Mon Jan 1 00:06:32 1601 mtime=Mon Jan 1 00:06:32 1601 atime=Mon Jan 1 00:06:32 1601 length=0 window=hidenormalshowminimized"38:T748,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAUJSURBVFhHrVftT1t1FO5/si8OaDt5jbRAaTfNEhwNrlAW49vc4vyiJjMaE6OO+UVNjMZoTMb2wQ/IwttwwCCRiYjyspFOZYMsMBXoBrS8lpbelrX3Pp7f795Ce+ntLWQ3Obm39972ec5znnN+vxoMBzhgMIBHgxLK5wP8VHZfYWCzDgf8jgL4Kwvgsxfunu30md+Tw19ZiKXj+Wirr6evPYGDgfttRVjmoIUyuEbIz2SCK/ZieEpKDk6CAysZaQHq35fVgcm0PyIMfK0iIat2xvoEZMWWSA2v1ZodiUTmvJ4Z5N7PM9kzhYBeSRj4or2Iy7YfgGzeZSR8tgIy8yFtJaaPKw5/QpmrifHEKKg30pCgnr78vhnTz+4je0cR/EcpHCRxpkhKiCmx4FR3Bwxw9ebB3WPExS9MmKwwY74yf28ZCHC52g6hqwOxfx9ADG1CDG8iturF1j/9eNhVjbk2K+ZaLRSlmGtJDW9TKXzNFoR/KQcmk+aE01MCV18uanuNeLXNiL/KzbhLsZgYOkoGa2dOQejpBEQRsbiEtZCE1ZCIx3QtSRLCS0Pwjb2D2W5Laly3YP5aKQI/l0MYsiE6UonocPluGdyUveuGkRNgcem8CX+SCn9biQidl4gAA5cIeFOQ8HpjCLZPA7BekKP8YgB13wSxtCFCJCK+W+8SgTI86rBglc6RYQIc3Y2Icr3jhVoCdyngjMDbV0zof8GMCSLAYub5MoS62jn49/0RWBsCsBCwOj5uC8O7JiLsvw3fzVps/VoB4Q/KOAmcXaclkMg+cX7jR+MOgZX2ZkjxOE5fCmmCJ8jUfBVEXJQgbt7ZA5yqgg20orHON4ApoCbADDl2TFZAmL5PNQeXPV3myffKSJ2tCHlie5UI2DVJRMgHtGLB0EDtpwZPfP7gWxN+rzqC2MY6Nxyrtx4B9nzGFye/RBEdc2RUwTtK45kTSKMAI/FSpxGN582IE4GVoJgVOCMw9Sg7AjQWlRIkGVCtRn23EcGHD7Adk1BGbtdTgBmUmRWP1zOXYJQ8wErAWiG5A9KV466ng1pfxMmvg7oEnvtsk88FMTiZUf4oI8BNSIfrBs2BDCqc66vA7dleLKyL+LAlrEniDM2HCW8MgY0JbNx5JXMXjNh214TaXhMNojxNM9bR849GXubtNb8iwvllEMztiXIw2VnmE/MxPiG9UxcgjB7N2AGRZAKua/kErk0gUZZPxl7DuG8AMSISpFa7vxDHPW8cAao5k31q2YPLo+8ReOrk2zOIqAW36Z3dVbHNgJM9+gTcfWacGzgGj38QK8IihFgYEYo1YRn3/ON4q6cK33UX69SeyFH28DhTl2THoEOzBOnnhAl13WbUXM1FdVMOTjQdxtW+YgTpx9UZp0xAei7JC9HePQEDYsuy1mBS33d15eFE82EOXk3x31CZDrhcmh33q3ftb/Jl+YjmYFITONWZCycBs/j8p6f1pafW2yCl0++IFDbuVqusgsZ0TCbxYmceBz/bkofxAYuu9EEZXP9wdpegjrdl5nK422UFZga1pedL7y2S3aOTuZpWVd9Tul6oac2BuzkHIQ3jsV6Pju2YTj/zNG/g9A+HeEnYjkk9Lc+2G/HbzWf27HZY1gKB+0lyxXDZSa9FkalRc52mJeuSxMQkQld6i7A6XAGeKQ+227EhTLsg6JntQHrIvQu2hNfT8PI0llBtKWhVY3/VFXdndrkK+H+QhDPhlF5PFQAAAABJRU5ErkJggg==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAzO7kAAAAAAAAAAAAAADMzMzu7u7sAAAAAAAAAAAMzMzMzu7u7uwAAAAAAAAMzMzMzM7u7u7uwAAAAAAAzMzMzMzO7u7u7uwAAAAADMzMzMzMzO7u7u7uwAAAAMzMzMzMzMzO7u7u7uwAAADMzMzMzMzMzu7u7u7uwAAIzMzMzMzMzMzu7u7u7sAAjMzMzMzeP//hzu7u7u7sAMzMzMzN4////h7u7u7u7ADMzMzM3/3ZmZ/+Lu7u7uwAzMzMzOPhmZmaP+7u7u7sAMzMzM492ZmZmZ/+7u7u7ujMzMzP/ZmZmZmb/u7u7u7MzMzMz/2ZmZmZm/7u7u7uzMzMzM/9mZmZmZv+7u7u7ujMzM5n/ZmZmZmb/u7u7u7AzMzOZj4ZmZmZn/7u7u7uwMzMzmZj4ZmZmj/u7u7u7ADMzOZmX/4ZmZ/+Lu7u7uwCjM5mZmXj///+Iu7u7u7sAozOZmZmZj//4u7u7u7u7AAI5mZmZmZmZmZmZmZmZkAAAmZmZmZmZmZmZmZmZmQAAAJmZmZmZmZmZmZmZmZkAAAAJmZmZmZmZmZmZmZmQAAAAAJmZmZmZmZmZmZmZAAAAAAAJmZmZmZmZmZmZkAAAAAAAAAmZmZmZmZmZkAAAAAAAAAAAmZmZmZmZlwAAAAAAAAAAAAAAmZmZAAAAAAAAD/4AP//4AA//4AAD/8AAA/+AAAD/AAAA/gAAAD4AAAA8AAAAGAAAABgAAAAIAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAgAAAAIAAAACAAAABgAAAAcAAAAPgAAAD4AAAB/AAAA/4AAAf/AAAP/8AAP//gAH///gf/w==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3AAB2ZnAAAAAAAAAAAAeHh3AAZ3dgAAAAAAAAAAB3d3d3cGd3YAAAAAAAB3d3d4d3eHdnd2AAAAAHd3d3d3f4d3iHZ3dgAAd3d3d3d3d3+Hd4iGd3YAd3d3d3d3d3d/h3eIh4eHAHiIiId3d3d3f4d3iIeIhwB4iIiIiHd3d3+Hd3iHiIcAiIiIiIiId4d/h3eHd3h2AIiId4iIiIf3eId3iId4cACIh4eIiIiHh3iHd3eIeHAAiIf3iIh3d3d4h3d3d3hgAIiHh3eIiIiIeId3d3d3dgCHh3eIiIiIiHiHd3d3iHYAiIiIj//4iIh4h3d3d4hwAI/////4iIiIeId3d3eIcACI/4iId4iIiHiId3cAiHAAd4iIh/d3h3d3d3AAAIhwAAd3iIiIAHAAeIhwAACIcAAAAHd3cAAAB4iIdwAAiHAAAAAAAAAAAHiIiIdwAIhwAAAAAAAAAAeP+IiIdwCIcAAAAAAAAAAAd4/4iIcAiHAAAAAAAAAAAAh3j/iHAIhwAAAAAAAAAAAIiIePhwCIcAAAAAAAAAAACIhwf/cAj3AAAAAAAAAAAAf3AH93AI9wAAAAAAAAAAAPgAeIcACIcAAAAAAAAAAAAAB4hwAAiIAAAAAAAAAAAAAAAAAAAAAAD///////+Dwf//gcH//wBB/+AAAf4AAAHgAAABgAAAAYAAAAGAAAAAgAAAAIAAAACAAAAAgAAAAIAAAAGAAAABgAAAA4AAAAOAAABjgAAD48AAA+P4IAHj//4A4//8AGP//gBj//8AY///AGP//whj//8YY///MOP//+Hj/////w==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREREQAAAAAAAAAAAAARERmZmZmREAAAAAAAAAAREZmZmZmZkREAAAAAAAABEZmZmZmZmZmREAAAAAAAERmZmZmZmZmZmZkQAAAAARGZmZmZmTMzMzOZkQAAABEZmZmZmTMzMzMzMzkAAACRmZmZkzMxETM7MzMzkAAJmZmZmTMxRERFM7MzMZAACZmZmZMxVEREREO7uzMwABmZmZk5mZkVREREO7uzMAA5mZmZkzMzORdERDu7uzMAOZmZmTMzMzu7ZERru7uzADmZmZkzdmZndkRER7u7uwCZmZM5l2ZmZmZkREe7uzsAOZkzORdmZmZmZkRHi7hzADmZMzMzd2ZmZmZmR/i/szA5mTMzM7dmZmZmZmeIv7MAOZMzMzOzdmZmZmZnaL+7ADmTMzM7N4hmZmZmZni4uwADkzMzOzkzdmZmZmaPi7AAAzMzMzszd3ZmZmZm/4uwAAOTMzM7NmZmZmZmaPuIsAADOTMzuzZu7uZmZn+IizAAADN3d3O37u7u5maHj3sAAAAzh2Zme37u7u5maPewAAAAMwiGZm7u7u7uZ4h7AAAAAAEAiO7u7u7u7oiIAAAAAAAAAA6Iju7u7uiIYAAAAAAAAAAAB4iIiIiIYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==3c:T748,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAUJSURBVFhHrVftT1t1FO5/si8OaDt5jbRAaTfNEhwNrlAW49vc4vyiJjMaE6OO+UVNjMZoTMb2wQ/IwttwwCCRiYjyspFOZYMsMBXoBrS8lpbelrX3Pp7f795Ce+ntLWQ3Obm39972ec5znnN+vxoMBzhgMIBHgxLK5wP8VHZfYWCzDgf8jgL4Kwvgsxfunu30md+Tw19ZiKXj+Wirr6evPYGDgfttRVjmoIUyuEbIz2SCK/ZieEpKDk6CAysZaQHq35fVgcm0PyIMfK0iIat2xvoEZMWWSA2v1ZodiUTmvJ4Z5N7PM9kzhYBeSRj4or2Iy7YfgGzeZSR8tgIy8yFtJaaPKw5/QpmrifHEKKg30pCgnr78vhnTz+4je0cR/EcpHCRxpkhKiCmx4FR3Bwxw9ebB3WPExS9MmKwwY74yf28ZCHC52g6hqwOxfx9ADG1CDG8iturF1j/9eNhVjbk2K+ZaLRSlmGtJDW9TKXzNFoR/KQcmk+aE01MCV18uanuNeLXNiL/KzbhLsZgYOkoGa2dOQejpBEQRsbiEtZCE1ZCIx3QtSRLCS0Pwjb2D2W5Laly3YP5aKQI/l0MYsiE6UonocPluGdyUveuGkRNgcem8CX+SCn9biQidl4gAA5cIeFOQ8HpjCLZPA7BekKP8YgB13wSxtCFCJCK+W+8SgTI86rBglc6RYQIc3Y2Icr3jhVoCdyngjMDbV0zof8GMCSLAYub5MoS62jn49/0RWBsCsBCwOj5uC8O7JiLsvw3fzVps/VoB4Q/KOAmcXaclkMg+cX7jR+MOgZX2ZkjxOE5fCmmCJ8jUfBVEXJQgbt7ZA5yqgg20orHON4ApoCbADDl2TFZAmL5PNQeXPV3myffKSJ2tCHlie5UI2DVJRMgHtGLB0EDtpwZPfP7gWxN+rzqC2MY6Nxyrtx4B9nzGFye/RBEdc2RUwTtK45kTSKMAI/FSpxGN582IE4GVoJgVOCMw9Sg7AjQWlRIkGVCtRn23EcGHD7Adk1BGbtdTgBmUmRWP1zOXYJQ8wErAWiG5A9KV466ng1pfxMmvg7oEnvtsk88FMTiZUf4oI8BNSIfrBs2BDCqc66vA7dleLKyL+LAlrEniDM2HCW8MgY0JbNx5JXMXjNh214TaXhMNojxNM9bR849GXubtNb8iwvllEMztiXIw2VnmE/MxPiG9UxcgjB7N2AGRZAKua/kErk0gUZZPxl7DuG8AMSISpFa7vxDHPW8cAao5k31q2YPLo+8ReOrk2zOIqAW36Z3dVbHNgJM9+gTcfWacGzgGj38QK8IihFgYEYo1YRn3/ON4q6cK33UX69SeyFH28DhTl2THoEOzBOnnhAl13WbUXM1FdVMOTjQdxtW+YgTpx9UZp0xAei7JC9HePQEDYsuy1mBS33d15eFE82EOXk3x31CZDrhcmh33q3ftb/Jl+YjmYFITONWZCycBs/j8p6f1pafW2yCl0++IFDbuVqusgsZ0TCbxYmceBz/bkofxAYuu9EEZXP9wdpegjrdl5nK422UFZga1pedL7y2S3aOTuZpWVd9Tul6oac2BuzkHIQ3jsV6Pju2YTj/zNG/g9A+HeEnYjkk9Lc+2G/HbzWf27HZY1gKB+0lyxXDZSa9FkalRc52mJeuSxMQkQld6i7A6XAGeKQ+227EhTLsg6JntQHrIvQu2hNfT8PI0llBtKWhVY3/VFXdndrkK+H+QhDPhlF5PFQAAAABJRU5ErkJggg==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"401d979a5757f8a0eb2bb5fc9ff6a9c595f5328a8922ccba251ed2b75bbe0267","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794193407654,"unified_at":"2026-11-09T03:03:27.654Z","metadata":{"hashes":{"sha256":"401d979a5757f8a0eb2bb5fc9ff6a9c595f5328a8922ccba251ed2b75bbe0267","sha1":"fcdcef1b9c836c86d5dbd4f6b62385039f99562d","md5":"c5c6563f5954f160ac90a10d6f1aaaa4","sha512":"9a691c6f73b6a94233086de0efee217e2d1d3169560ea91e3fa1654c071f15cc7763b5b28b64e4786017d3a9eda9aef3f806a0498de5c0a637f036a3e7870177","ssdeep":"3072:B/gje7Ubx2ulkiHvTlkBPNNSD/K2DxtCWTbsutFOLXunsN+:B4j/x1lpHvTlqXSD/KCbVTbs+OLXub","ssdeep_chunks":["3072:B/gje7U","3072:/gje7Ub","3072:gje7Ubx","3072:je7Ubx2","3072:e7Ubx2u","3072:7Ubx2ul","3072:Ubx2ulk","3072:bx2ulki","3072:x2ulkiH","3072:2ulkiHv","3072:ulkiHvT","3072:lkiHvTl","3072:kiHvTlk","3072:iHvTlkB","3072:HvTlkBP","3072:vTlkBPN","3072:TlkBPNN","3072:lkBPNNS","3072:kBPNNSD","3072:BPNNSD/","3072:PNNSD/K","3072:NNSD/K2","3072:NSD/K2D","3072:SD/K2Dx","3072:D/K2Dxt","3072:/K2DxtC","3072:K2DxtCW","3072:2DxtCWT","3072:DxtCWTb","3072:xtCWTbs","3072:tCWTbsu","3072:CWTbsut","3072:WTbsutF","3072:TbsutFO","3072:bsutFOL","3072:sutFOLX","3072:utFOLXu","3072:tFOLXun","3072:FOLXuns","3072:OLXunsN","3072:LXunsN+","6144:B/gje7U","6144:/gje7Ub","6144:gje7Ubx","6144:je7Ubx2","6144:e7Ubx2u","6144:7Ubx2ul","6144:Ubx2ulk","6144:bx2ulki","6144:x2ulkiH","6144:2ulkiHv","6144:ulkiHvT","6144:lkiHvTl","6144:kiHvTlk","6144:iHvTlkB","6144:HvTlkBP","6144:vTlkBPN","6144:TlkBPNN","6144:lkBPNNS","6144:kBPNNSD","6144:BPNNSD/","6144:PNNSD/K","6144:NNSD/K2","6144:NSD/K2D","6144:SD/K2Dx","6144:D/K2Dxt","6144:/K2DxtC","6144:K2DxtCW","6144:2DxtCWT","6144:DxtCWTb","6144:xtCWTbs","6144:tCWTbsu","6144:CWTbsut","6144:WTbsutF","6144:TbsutFO","6144:bsutFOL","6144:sutFOLX","6144:utFOLXu","6144:tFOLXun","6144:FOLXuns","6144:OLXunsN","6144:LXunsN+","3072:B4j/x1l","3072:4j/x1lp","3072:j/x1lpH","3072:/x1lpHv","3072:x1lpHvT","3072:1lpHvTl","3072:lpHvTlq","3072:pHvTlqX","3072:HvTlqXS","3072:vTlqXSD","3072:TlqXSD/","3072:lqXSD/K","3072:qXSD/KC","3072:XSD/KCb","3072:SD/KCbV","3072:D/KCbVT","3072:/KCbVTb","3072:KCbVTbs","3072:CbVTbs+","3072:bVTbs+O","3072:VTbs+OL","3072:Tbs+OLX","3072:bs+OLXu","3072:s+OLXub"],"imphash":"2814efb2c8ebad5bf8e75abae72a841b"},"file_info":{"file_name":"eee","file_type":["peexe","executable"],"file_type_id":"exe","file_size":196608,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287986000,"last_seen":1662764624000,"last_multi_scan":1662764624000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":11,"malicious_count":7,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Spora","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1233264","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Spora.32","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.DX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Spora.32 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Spora.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005023b61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FLDZ!C5C6563F5954","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.elkrrz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.MauvaiseRI.S5242660","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Spora!g2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.Androm.196608.K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm.Win32.39458","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Spora.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00018688-00002488-0000010C-44887346","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00018688-00002488-0000010C-44887346","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"spora.biz\"\n \"en.wikipedia.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.88.7.60:443\"\n \"54.240.162.233:443\"\n \"35.161.88.115:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"firefox.exe\" (UID: 00026076-00000496)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c vssadmin.exe delete shadows /quiet /all\" on 2017-2-5.05:42:01.041","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Progman\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00018688-00002488)\n Spawned process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"\" (UID: 00026034-00003324)\n Spawned process \"firefox.exe\" with commandline \"-osint -url \"%APPDATA%\\US359-19ZTZ-TZTXF-THZTZ.html\"\" (UID: 00026076-00000496)\n Spawned process \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /quiet /all\" (UID: 00027030-00003688)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /quiet /all\" (UID: 00027054-00003712)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$37","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\odbcint.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\explorer.exe\\\"\n \"\" touched file \"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.pyload-security.com/download.php?file=Desktop%20background.png,ID:4,docshellID:5,docIdentifier:4},{url:https://www.payload-security.com/download.php?file=Desktop%2520background.png,ID:5,docshellID:5,docIdentifier:5}],lastAccess\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.81643002572","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"firefox.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"firefox.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"\" (UID: 00026034-00003324)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"eee.exe.bin\" claimed CRC 172255 while the actual is CRC 218962","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetModuleHandleW\n CreateFileW\n GetStartupInfoW\n FindWindowW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WMIC.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bfd5760000000056ccd576000000007ccad57600000000376833756a2c0977d62d097700000000206933750000000029a6d57600000000a48d337500000000f70ed57600000000\" to virtual address \"0x759A1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"firefox.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process using WMIC","description":"Process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"\" (UID: 00026034-00003324)","origin":"Monitored Target","relevance":5,"id":"target-23","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Deletes the shortcut icon for lnk files (often used by Worms to hide infection)","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\LNKFILE\"; Key: \"ISSHORTCUT\")","origin":"Registry Access","relevance":10,"id":"registry-59","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/57 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/57 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"54.240.162.233\" (ASN: 16509, Owner: Amazon.com, Inc.): ...\nURL: http://a82e7caa1c13ffbb93944569121ee6f2d.profile.fra6.cloudfront.net/ (AV positives: 1/65 scanned on 10/21/2015 07:10:24)\n URL: http://ac1fc451a66e3b49025ba6a7e104bf64d.profile.fra6.cloudfront.net/ (AV positives: 1/63 scanned on 08/31/2015 14:08:15)\n File SHA256: c638d79395a5396b28a097bc1046048f8f64e9d2f1de0a35cb375749649eb16a (AV positives: 39/57 scanned on 11/11/2016 21:47:51)\n File SHA256: 886b11956faaa022e24f92cb30bcac0ea0d0507200139c96e52d29b8401762ff (AV positives: 25/54 scanned on 01/21/2016 22:58:33)\n File SHA256: 790716cee52e97e7f3a32fe587c46bbbfb5295a75732e5d695d4e11b902a1c36 (AV positives: 24/56 scanned on 01/19/2016 19:51:25)\n File SHA256: 8dc85cde42ecd4691a93dd5c5f942eea281c6c5cd92e1e96da5494e20c55b708 (AV positives: 29/54 scanned on 01/19/2016 03:03:47)\n File SHA256: bf55785b24b61a9f73e66100ed71108828f23e18898c4f48972dbbf62701ad06 (AV positives: 34/55 scanned on 01/14/2016 23:01:43)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /quiet /all\" (UID: 00027054-00003712)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00018261-00002100)\n Spawned process \"\" (UID: 00018688-00002488)\n Spawned process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"\" (UID: 00026034-00003324)\n Spawned process \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /quiet /all\" (UID: 00027030-00003688)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /quiet /all\" (UID: 00027054-00003712)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Deletes the shortcut icon for lnk files (often used by Worms to hide infection)"}],"sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":136,"dropped_files_count":0,"extracted_files_count":27,"files_written_count":259,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"589714ecaac2eded6cde02f4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","contacted_countries":["BLZ","NLD","USA"],"submit_name":"eee","analysis_start_time":"2017-02-05T13:05:29+00:00","indicators_count":{"informative":14,"suspicious":16,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"52.88.7.60","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"address":"54.240.162.233","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"address":"35.161.88.115","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}],"dns_resolutions":[{"domain":"spora.biz","address":"186.2.163.47","country":"Belize","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"domain":"en.wikipedia.org","address":"91.198.174.192","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}],"processes":[{"pid":2100,"ppid":0,"name":"eee.exe","command_line":"","normalized_path":"C:\\eee.exe","uid":"00018261-00002100","icon":"$38"},{"pid":2488,"ppid":2100,"name":"eee.exe","command_line":"","normalized_path":"C:\\eee.exe","parent_uid":"00018261-00002100","uid":"00018688-00002488","icon":"$39"},{"pid":3324,"ppid":2488,"name":"WMIC.exe","command_line":"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00018688-00002488","uid":"00026034-00003324","icon":"$3a"},{"pid":496,"ppid":2488,"name":"firefox.exe","command_line":"-osint -url \"%APPDATA%\\US359-19ZTZ-TZTXF-THZTZ.html\"","normalized_path":"%PROGRAMFILES%\\Mozilla Firefox\\firefox.exe","parent_uid":"00018688-00002488","uid":"00026076-00000496","icon":"$3b"},{"pid":3688,"ppid":0,"name":"cmd.exe","command_line":"/c vssadmin.exe delete shadows /quiet /all","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00027030-00003688","icon":"$3c"},{"pid":3712,"ppid":3688,"name":"vssadmin.exe","command_line":"delete shadows /quiet /all","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00027030-00003688","uid":"00027054-00003712"}],"all_imported_dlls":["rpcrt4.dll","netutils.dll","propsys.dll","icuuc52.dll","MMDevAPI.dll","mscms.dll","atl.dll","wbemsvc.dll","NapiNSP.dll","samlib.dll","vsstrace.dll","psapi.dll","msvcr100.dll","dwmapi.dll","SensApi.dll","rasadhlp.dll","RpcRtRemote.dll","usp10.dll","cscapi.dll","msxml3r.dll","AudioSes.dll","ntshrui.dll","shell32.dll","drprov.dll","pdh.dll","userenv.dll","imm32.dll","Wldap32.dll","browsercomps.dll","msctf.dll","dnsapi.dll","winmm.dll","odbc32.dll","advapi32.dll","winsta.dll","setupapi.dll","wsock32.dll","icuin52.dll","nlaapi.dll","FWPUCLNT.DLL","devobj.dll","mozalloc.dll","msvcrt.dll","sechost.dll","comctl32.dll","msasn1.dll","oleacc.dll","wbemprox.dll","ExplorerFrame.dll","duser.dll","msimg32.dll","mpr.dll","WSHTCPIP.DLL","winbrand.dll","msvcr90.dll","gkmedias.dll","wkscli.dll","rpcss.dll","DWrite.dll","rtutils.dll","KernelBase.dll","srvcli.dll","MSOXMLMF.DLL","mozjs.dll","icudt52.dll","xul.dll","winnsi.dll","msvcp100.dll","rasapi32.dll","cryptbase.dll","davhlpr.dll","freebl3.dll","ntdsapi.dll","sandboxbroker.dll","nssckbi.dll","vss_ps.dll","gdi32.dll","Wpc.dll","wship6.dll","slc.dll","sspicli.dll","iertutil.dll","oleaccrc.dll","secur32.dll","odbcint.dll","profapi.dll","ws2_32.dll","wshqos.dll","version.dll","wbemcomn.dll","mozglue.dll","samcli.dll","wintrust.dll","softokn3.dll","shlwapi.dll","davclnt.dll","clbcatq.dll","tzres.dll","dui70.dll","oleaut32.dll","uxtheme.dll","cfgmgr32.dll","ole32.dll","apphelp.dll","fastprox.dll","nssdbm3.dll","vssapi.dll","user32.dll","mswsock.dll","ntdll.dll","mfc42.dll","lpk.dll","crypt32.dll","rsaenh.dll","browcli.dll","nsi.dll","winrnr.dll","ieframe.dll","urlmon.dll","nss3.dll","netapi32.dll","pnrpnsp.dll","dbghelp.dll","ntlanman.dll","netmsg.dll","ntmarta.dll","framedynos.dll","IPHLPAPI.DLL","msxml3.dll","rasman.dll","cryptsp.dll","wininet.dll","wtsapi32.dll","wevtapi.dll","linkinfo.dll","kernel32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"E6V0C7E55ADMBHNL7W0Z.temp","sha256":"1b0851ca5a91bcdeeb06274e2dac7aa20acd4dfc6aae383cfd8e124773a27dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"JFQ5DNQRZ00OFCZF2EMW.temp","sha256":"1b0851ca5a91bcdeeb06274e2dac7aa20acd4dfc6aae383cfd8e124773a27dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"TXYZLA3FYRA4YXCSZZHZ.temp","sha256":"1b0851ca5a91bcdeeb06274e2dac7aa20acd4dfc6aae383cfd8e124773a27dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"3275956978","sha256":"8ebfa98a710cd34027db88d97f54a733ba5ff6268cf30e2bbaad391172ab98e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"cert8.db","sha256":"85d74fc3f7618e38f5fd30cc2b2eca7d085627a2fc3ac3afdba255834604da9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"content-prefs.sqlite","sha256":"53c8da0ace0a569a05e28177fbf4c1f5db440d74cbfba11810baada647066088","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"content-prefs.sqlite-journal","sha256":"0b93af8a4dbb6a33a68a830659147c7051baf09eb9573663e468f9180f729f2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"cookies.sqlite","sha256":"5f1d14b2ce3e4127059ee8a1eaa5fe542e3579f2149552a9d53bd6b4bcb9a491","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"cookies.sqlite-journal","sha256":"04f9a3f4073fe0d2399e09dbac24f3b252c94bcb095c74de264062ce796f5b54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"cookies.sqlite-wal","sha256":"063cef617a7a0a77397ee0f7c351968aad1d40f9df6cc0755bdeb88edce789dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"store.json.mozlz4.tmp","sha256":"078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"formhistory.sqlite","sha256":"d3b753b575e4345f4fecfa3ce19459806031f133678e25a3a8fbb8783d3cfe58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"formhistory.sqlite-journal","sha256":"087f1e42e5a5cc5ec18c17ffa51ecbf5268894bc4566c96c0c734545204ea1ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"gmpopenh264.info","sha256":"ac5630d4ee33fee680fce34437625b29435a3e2472393eda86c27f05df36ad05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"healthreport.sqlite","sha256":"7f5e8938328ba7d78d45ae6fb3520f11e403e02f978f8b59b76dfab1045bb0b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"state.json.tmp","sha256":"5ee92a5dda3640b3c8674c5ec98bdb3df80a5e9806d8ae7957234a1132acbc8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"permissions.sqlite","sha256":"f8ede4201a24ce8b8b8ce50cb9d845c901eaab27fc48f6f833d366a581a0ec79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"places.sqlite","sha256":"bf49841a67b9f9c8bf327309d166a799092ca7402d4117d95b3b601a7a484aef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"places.sqlite-journal","sha256":"6a6841a5c5b2deab72babbb1ad542f859441bfd1cca947340357cfb5c4c12f04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"places.sqlite-wal","sha256":"7e59c512bbaa41ac92f003689872d7730c18b15747472162a6328ffdf9f771c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"Windows.lnk","sha256":"f3e88092f3ec60c064f2d02ef1ac9f4c2de846a476fd245d598651da03eb86f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"PerfLogs.lnk","sha256":"c67107d053ef6749635b9259e46c4ab3547608990b8c9d243f324c4d9c55af2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"eaEn8.lnk","sha256":"aaf386b46424ce8ce19d69db109047b8f85029cc025cf63c594cf85d31d38c7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"gL10TVgg.lnk","sha256":"cf254da4ac2d1dc962a7e98e8e72742a0e3b21d5b278472395f0dbb81ded7253","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"Program Files.lnk","sha256":"238ed94ae974a319cab44af4da36d851c96c735930416042ec61a535344f1aec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"Users.lnk","sha256":"f41cfa5442c80f467bf9b6dc651db21b121783e023b22513af7ee8fda0405931","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"ITbeUHTI.lnk","sha256":"30c375323e56722c9feece218e2d057cc6fb05462ca9dd4b25fc81ebcea7896a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}],"files_written":[{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"C:\\myapp.exe","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"C:\\eee.ex_","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\CSIDL_","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"C:\\eee.exe","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\CSIDL_X","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\3275956978","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\dependentlibs.list","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\MSVCR100.dll","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\MSVCP100.dll","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\mozglue.dll","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\events","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\InstallTime20150122214805","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\parent.lock","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\events","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\compatibility.ini","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\omni.ja","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\omni.ja","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"C:\\mozilla-build\\msys\\local\\lib\\icu\\icuplugins52.txt","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\chrome.manifest","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\defaults\\pref\\channel-prefs.js","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\chrome.manifest","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\components\\components.manifest","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\startupCache","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\startupCache\\startupCache.4.little","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\user.js","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\extensions.ini","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\chrome.manifest","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\A0U7KZ~1.DEF\\secmod.db","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\A0U7KZ~1.DEF\\key3.db","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\SiteSecurityServiceState.txt","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\update.status","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\00FB7E835F7E9D8EA3C91E10ACAEBC3CBEB6F319","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\03E27938A4BD55FAABCC8F86F76523107C32F096","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0465F1BE81842BF190E758CDCD7D7F7624ECA2E4","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\04F4E02F65ED8630D7BC592B6D36376DF46FCD72","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\05226AC7374E745CB49D655CEBBB42B7D43D2C65","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\05DC37A0E58ED2C012FF4DB75EFEA673B4B62911","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\06CCDA09A7CD309D452F564A366677EFFA261BF6","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0CADC78C46BE7A5612780FC958D945A6B80DE4AF","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0D6A463CA85FBEB41A8ED88BDB87527AF5F08633","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0E04B803C3E03DCC860947A7CC7909866FAAAE72","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0E1AA0B656DFD7D8E2E0F591C6FBECE42B260C44","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0E88A8084D97F063E51EDF49ACDD3F482D758767","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\permissions.sqlite","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\105D3A9432C01FB6F8166B336A22A16EC9BD32F9","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1242184E2E0877DC23765B2E94120EF39ECB2FA7","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\129518677723B0A053599EE4A18409F4097A74D8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1974E1FA52908FE2C537708B973C70F1059495C3","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1B1D639857BDB036BC82E5FA867F24B47E07F3DD","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1ED22E6023DE3861DF916105B08793703EA187BA","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1EE4BA35A23C3C40FEB400CED3A71B574E426753","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1F7512783D6579EE374646C3966BE1339A171863","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1F94FF97F14F7069A0281E9DD371D85853F633B1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\21A823D16A76262B80CA174B01EABF58B09603A5","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2225C11E0A4957C3CCE034FC178F517B3B8BBFCC","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\25DFD13EC574514F96A829EB97492CDC40882F50","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2A57B8B6746E10488C5DA17729B4B9DC68B590DE","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2D54F056066AFCB773375626114E4FE638CA851E","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2E0C4058E084A83FFD5E59DF25634B4708213893","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2E3AA54756007309B4045F5A901E712F2CD08C7F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2EC7F0910BAF664518D0D625A8CDE292D53D2E97","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2F2D5C85951F8DD45C5EE29DCAB3EFFADB02DAD0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2F7AA022C3033A49733E4ACACB790B0AEA33EE06","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2FFB54B8BC074FD0461F56092C885213BD24DDFF","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\30088D5D85648DB1D8C4B6BD16379983DD45F675","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\301AC4A68A1B88E805A8B43E846F037D3AEA2138","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\30FD3153020EC77A1653849D46E42E0B4006C633","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\32E847CBC2079ACB3110B7EBA72E543D4F0D1C68","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite.corrupt","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\352FFEDD2461749BC5A2B2281CBCDBD97361D5A8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\353B172F0EAF86EFA9203B76EC8BAECD317F6F6F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\370E8064FD17CBCCAE8437A1885B7DCF9B6E0B12","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\371BD8867654493BF84E4D7444C89957753D3613","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3880321EFEC4B670DBEF674079F6D91C515BC7FF","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3CBA8E27010FAB192E82890AA7F8FC12B88F0AD8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3DD95C5B94B60B8EAC8D15C50B4DE3EF45A9D2A8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3EED435B3241E216CAE28B301DFDDB3718BBDFF0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\40B3EA222D2040213EB24EF69944B5F903CF34B5","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\434B22F05630088EC7BC33A1723255BBF9579E5F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\447A80CE277350756F838E0A8161628BED64CF78","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\474B042F28F7096D3A3E1782368560B58A64CE57","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\48AD1F20753B6AE0CBF91C027BB14E84FA90A0F0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\48C1474958A4DE1F1C13E433352B9CCDDB3510D0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4972A306778C47F464CD59D7AD7BDF15C05CA36E","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4C5BA9BC62328203ABA3C351469D46DE8C262D63","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4ECB89424430E2F2E55082743FAE5F80053C7437","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4F6AEE0B2336FC2D32934E5A0D1363A7C229C7CC","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4FEF67DB9162C4577485CC3B2E848ABE708A8A6C","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\51F1D2C71B78BF7ECCBCC4E4084E50213562B51B","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\52C0C1A51470FC7CA19F7465313DA4FF48BFA363","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\533880D31FD5327CA77924436876812BC8F3D7E9","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5429450E2E294B8E09159087D4A501B12FFEC93E","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5485C935CC30BC107CA333E40B0139C57BCDAB12","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\555828B93E32D75FABFE0BACD99384ED715DCC85","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\57E9D595061288F3914C46A0D0EFDC239404553F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\590907C9A33CF61DBC08F99143DCEE1C1119751A","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5AC565FD91A0D787A771C2B23CEDC0AA77BEFD7C","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5FAC2B51FD76043D24AF5FE3A0042094F9402CD2","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\638E2612BBEBE3B29274D8A7D8E048124FB05080","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\676ADB2097AAFE4CA0B991D27193308C0E35EF1B","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\67EDA5829C6ECDFC340C5D6FFF732E9EC1286D8A","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\681F82A39945572A06375C7584B5C2718F76072C","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\69992ACAF5F252D9AAE87D1E83837B752B665C5F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\6DF4C247EB188DBE3AA7FEFB8B83F5C21339C17F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\6F8FB4D82C35910ECF7AB512D58576D942963BA4","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\704FDD0ADBE88879909251B18BCDA324E5C0C6FF","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\708FF29D7D9CBC05733F334E3C64555866512C03","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\73460A701FF1F49FAD2A187BFF88ACD24D73DC22","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\76797554FCFEF85503E570F4FBE5ACC09B95DAC2","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite-shm","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7AC434CD10C735364DFC8BF9AC210FC86607D419","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7C1F728C888643340F6BFF77FCFCC33956677562","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7E766EFF450C1A09D1BE673F808C44C1DC716CF5","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7ECF1B7C23F6650D0A553829D9F753FE0A072515","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7F12A27AC17BC481D93CD9C0AE94CB8148A1FA0D","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\817E4769CDAE452B81442549D2F9968F739715A8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\81A6829B07CED4AAA179B90710FA7E1CAF865703","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8289505E777C3ACDC40F8CA2492B08006C5861E8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8321793CE0669F6623B650DC53CFC5C3401E64C2","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8570BAC7E9E80CD01BB4F3C1A7F318E45CDA7494","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\87D21E588A758F55C79B1A80AF53F5DE8F97BD07","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8857F3033ADD4EB28817638302A934EFC707BBDC","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8B2F1DA32829D8FA2C7D3870B22BA5121A24A273","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8C0FDCA4DC1D3CC4A01D5AECDB6033424805BA4C","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8D2EAF9A088E2EE4277C2E297CFC26C1D6377041","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8D5C460ADDC2F1F7EE333834D1754B11BAE09C21","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\90315B08C7EA5741C86D44F3C1B5420F168BAC3F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9097930649FE7A5ED5C370E284F3159B56458EFF","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9276FE696600CB50F895AE7C9174CFCFFE07D923","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\92A3C973FACB33FF0162AF2202B1ABF0428228FA","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\931F4A22FACB88129776074AAF555C2C5A045EE4","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\94819098B9D2C4279A6112A11E3358BE68580958","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\95E30605786E73CC205725268CB638D76F46E4F2","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\95EA667D4D2DE43B5E8CEEE88E517AAA028F72EC","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\96BC283800385EA51B5A0C9CA8055A144AEBF24A","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\97B8276E1B45E6C0C01BFE8C091D416310B3D7FB","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\996FF69B28B46AA08240D5B033726E178EA73F53","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9A07B5BA4FDCEED8E6D42A3C90768F04B2A9C8AE","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9EE02001B4F4CADACC54DF5B2E91317FB81ADAEA","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\A350F82A64F2880D28FB1921E92057E4A610BFD1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\A5AE7C975DF0B182D35B945F55504D011B8004D0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\A6158820868096C47EA71CED39728F941D77E6D5","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\AA5588C93D95518EF899D6C5A9FE354E92238BCD","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\B053E3AD2CAA0768C4EB7584A171C603331CD93A","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\B20BF410AEE199A12708CA21DABF65AD2AE2BCF8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\B9403F5B1405E5000246F2AC6EF5A6886E312511","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BB1913A2380BABE37897EA2B94E177C717530A5B","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BB7456C8D68B3D4A2EB2E4554D63E2CFE4EEC90D","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BC20A45B3DCD784841C1D1DB98F042F71D4A5C25","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BC84AA1DE91E102FE8821F76E4D3382C5478F8C8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BCA3931218FA68066E7D851877F37B14DE8B2E93","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BEBEE734DC8E94FA255A22C5E3CA667757BE30D8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\C094437F984D96F2D01C36CFABCBF9CA4F2EBBA6","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\C304A01B70FA48AFE3DC36261831A7526B04A80C","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\C8BE3BBD215F0457C0AF18601EB2AB9102D9DD08","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CADE55E969FAEEC35F2A22A08F146E1965C33911","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CB05A88751F6B2B79CA839255A4890B427F23AA1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CBEC613E5CFAB507A1C654E90F59982CE8EAC680","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CC5383081CDB993E393091792FFE88CDD5D0C4D5","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CE95114622634B41823E2186167B85810C065D80","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D057BD0D21CBA6CDCECA79A5F78A0163EF348BC6","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D1DD34E8641EA828676BD98C89DC0434EF10B0F8","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D36FD0721F11A7AE28A82198D72211B81B3A7CD3","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D37A5F8E64C609CDEBE714E3412E8AF88334504E","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D42FD60FBF95B9FE1D02FB6197FF24B81AE234D1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D44BD2282850C5677731142E8E41A4715B1D2173","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D617B4A50D4DF9418CC46991A46B46457FA08387","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D8DF957C2A0EDB79F6B0B7FCCAF8A1BD1021C282","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DB2012FA1EEB48278BE39A073A4C19541807393D","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DB83FC691E21BC77F6D161A9BD5015D7D63E2BB4","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DC1863701DE3B4BF3A49F4CA7C2389E27D26955F","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DDE05E6CD4B04C1396A7C1C978F92FA7B82DC8E1","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DE6F2EA50E4D5FE5ACB8C8C33CE12306F6A1685D","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DF8288208B71302823466AFC0C55FC462241566C","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DFA43D30A714AA169350273B86EAF29F625A85DD","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DFD1C2C4553F5E655521E5BE8AB71DCA244318F7","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E071FB500DBE3B8E9C2DB2464A7B5E090139BBF9","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E1884D9BEBEF9545BC8C8F00719085B071C60582","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E190DB789DC1C308BBF565F2277C09949CB02650","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E245013D019AE596820CB52129E842FBD0054F1E","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E325B486B777C14C29762600D998974140F8FD34","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E6913B75D6EEB6FE59DCD485FC9C54BB751E4061","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\EC704D06E5277E22B5179F13A1761CB068985AAC","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\EF31F4F06DBFD9469F03AA2C92191DFB5075F65A","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\EF6776722884E7D4E225C23DC9E5605501416DEC","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\F277DBFB73069EA798E618645936AA6A1B8AD356","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\F4289F4DB3103AA2D9EEACDEA4B88CF78B9D8F1B","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\FC1ACC47459A1C5DDEB33199E979D2351D3913F0","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\FE582363364A5991E97E5ACBE5B585AACB9A6DF2","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\wbem\\XSL-Mappings.xml","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite-wal","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\content-prefs.sqlite.corrupt","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\content-prefs.sqlite","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionCheckpoints.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cookies.sqlite","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\en-US\\WININET.dll.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\webapps.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\xulstore.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\US359-19ZTZ-TZTXF-THZTZ.html","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\mimeTypes.rdf","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionCheckpoints.json.tmp","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\bookmarkbackups","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\search-metadata.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\signedInUser.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\state.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\blocklist.xml","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\search.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport\\state.json","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\bookmarks.html","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport.sqlite","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\searchplugins","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\store.json.mozlz4","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\GRAPHIC\\","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\GRAPHIC\\RECENT FILE LIST\\","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\GRAPHIC\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\UACMut","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\m3275956978","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wlztmhx!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wlztmhx!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wlztmhx!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\FirefoxStartupMutex","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MozillaUpdateMutex-aeVcDEW6vlSu+PLYtSFCvWhPsG0=","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"589714ecaac2eded6cde02f4"}]}]}},"report_ids":{"sandbox_job_ids":["589714ecaac2eded6cde02f4"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Ransom.Spora.Generic Sample 401d979a5757… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 401d979a5757…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/401d979a5757f8a0eb2bb5fc9ff6a9c595f5328a8922ccba251ed2b75bbe0267"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Spora.Generic Sample 401d979a5757… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 401d979a5757…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/401d979a5757f8a0eb2bb5fc9ff6a9c595f5328a8922ccba251ed2b75bbe0267"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Spora.Generic Sample 401d979a5757… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 401d979a5757…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]] 32:null