21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4a9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Spora Sample e3af61658332… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e3af61658332…. Malware family: Trojan.Ransom.Spora. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9","keywords":["Malicious","Trojan.Ransom.Spora","malware analysis","sandbox report","threat intelligence","e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9"],"about":{"@type":"SoftwareApplication","name":"welcome to dreamland.scr","applicationCategory":["peexe","executable"],"identifier":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Spora","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T40d,"WMIC.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document" (Path: "HKCU\WOW6432NODE\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "vssadmin.exe" touched "VSSCoordinator Class" (Path: "HKCU\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}")23:T91a,"Windows.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon number=3 ctime=Sun Dec 31 23:06:32 1600 mtime=Sun Dec 31 23:06:32 1600 atime=Sun Dec 31 23:06:32 1600 length=0 window=hidenormalshowminimized" "PerfLogs.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon number=3 ctime=Sun Dec 31 23:06:32 1600 mtime=Sun Dec 31 23:06:32 1600 atime=Sun Dec 31 23:06:32 1600 length=0 window=hidenormalshowminimized" "setuppackages.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon number=3 ctime=Sun Dec 31 23:06:32 1600 mtime=Sun Dec 31 23:06:32 1600 atime=Sun Dec 31 23:06:32 1600 length=0 window=hidenormalshowminimized" "Program Files.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon number=3 ctime=Sun Dec 31 23:06:32 1600 mtime=Sun Dec 31 23:06:32 1600 atime=Sun Dec 31 23:06:32 1600 length=0 window=hidenormalshowminimized" "Program Files _x86_.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon number=3 ctime=Sun Dec 31 23:06:32 1600 mtime=Sun Dec 31 23:06:32 1600 atime=Sun Dec 31 23:06:32 1600 length=0 window=hidenormalshowminimized" "92d69010-ef8e-f6bf-db23-6d0ac5aa0e69.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "Users.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon number=3 ctime=Sun Dec 31 23:06:32 1600 mtime=Sun Dec 31 23:06:32 1600 atime=Sun Dec 31 23:06:32 1600 length=0 window=hidenormalshowminimized" "Tulips.jpg" has type "data" "GreenBubbles.jpg" has type "data" "_684A0AD5-193A-11E9-9FD4-0A002709B68F_.dat" has type "Composite Document File V2 Document Cannot read section info" "Jellyfish.jpg" has type "data" "Bears.jpg" has type "data" "US44E-31ZTZ-TZTXO-TOOTZ.HTML" has type "HTML document UTF-8 Unicode (with BOM) text with very long lines with no line terminators" "Pine_Lumber.jpg" has type "data" "~DFAA67D13FFF45143C.TMP" has type "data" "~DFA3CD607131DE1E1B.TMP" has type "data" "Stars.jpg" has type "data" "Garden.jpg" has type "data" "Hydrangeas.jpg" has type "PGP\011Secret Key -" "~DFB0BD1F4140CEEE41.TMP" has type "data"24:T610,".exe" touched file "C:\Windows\SysWOW64\en-US\odbcint.dll.mui" ".exe" touched file "C:\Windows\SysWOW64\en-US\MFC42.dll.mui" ".exe" touched file "C:\Windows\explorer.exe\" ".exe" touched file "C:\Windows\Fonts\StaticCache.dat" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "iexplore.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "iexplore.exe" touched file "C:\Windows\SysWOW64\en-US\odbcint.dll.mui" "iexplore.exe" touched file "C:\Windows\SysWOW64\en-US\MFC42.dll.mui" "iexplore.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "iexplore.exe" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "iexplore.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "iexplore.exe" touched file "C:\Windows\SysWOW64\ieframe.dll" "iexplore.exe" touched file "C:\Windows\SysWOW64\stdole2.tlb" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "iexplore.exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "iexplore.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "iexplore.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"25:T8fd,".exe" wrote bytes "711130017a3b2f01ab8b02007f950200fc8c0200729602006cc805001ecd2c017d262c01" to virtual address "0x769107E4" (part of module "USER32.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x75454EA4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "0ef93720" to virtual address "0x7072B9F0" (part of module "OFFICE.ODF") ".exe" wrote bytes "b4364575" to virtual address "0x754601E4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a4575" to virtual address "0x754601E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4364575" to virtual address "0x75460200" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x75454D68" (part of module "SSPICLI.DLL") ".exe" wrote bytes "60127e74" to virtual address "0x768AE324" (part of module "WININET.DLL") ".exe" wrote bytes "b8b0157e74ffe0" to virtual address "0x754536B4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a4575" to virtual address "0x75460274" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c0dfbb771cf9ba77ccf8ba770d64bc7700000000c011a17600000000fc3ea17600000000e013a176000000009457f07625e0bb77c6e0bb7700000000bc6aef7600000000cf31a176000000009319f076000000002c32a17600000000" to virtual address "0x77141000" (part of module "NSI.DLL") ".exe" wrote bytes "b830127e74ffe0" to virtual address "0x76BF1368" (part of module "WS2_32.DLL") ".exe" wrote bytes "b4364575" to virtual address "0x7546025C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a4575" to virtual address "0x754601FC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b840137e74ffe0" to virtual address "0x75453AD8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x75454E38" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x75454D78" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a4575" to virtual address "0x75460258" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4364575" to virtual address "0x75460278" (part of module "SSPICLI.DLL")26:Tc1b,".exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 236) ".exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 236) ".exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 236) ".exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 236) ".exe" wrote 4096 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 236) ".exe" wrote 14848 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 236) ".exe" wrote 1536 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 236) ".exe" wrote 32 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) ".exe" wrote 52 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) ".exe" wrote 4 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) ".exe" wrote 1536 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) ".exe" wrote 16896 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) ".exe" wrote 8 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) ".exe" wrote 400 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) ".exe" wrote 4096 bytes to a remote process "C:\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe" (Handle: 240) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 956) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 956) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 956) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 956) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80)27:T4f1,Found malicious artifacts related to "54.240.162.82" (ASN: 16509, Owner: Amazon.com, Inc.): ... URL: http://a1fc1b60267e1e49c55cc6ac3a114322d.profile.fra6.cloudfront.net/ (AV positives: 1/65 scanned on 10/22/2015 22:17:45) URL: http://a47af5006db2a434846847df6fea4c3de.profile.fra6.cloudfront.net/ (AV positives: 1/65 scanned on 10/07/2015 13:22:29) URL: http://a1ce4a5fcdcfe2073d628735c80ec55f2.profile.fra6.cloudfront.net/ (AV positives: 1/63 scanned on 08/29/2015 13:02:23) URL: http://a3a79110dbe1d9656535288691c140892.profile.fra6.cloudfront.net/ (AV positives: 1/59 scanned on 09/25/2014 21:06:51) File SHA256: 52a11a715d4e0f55cee7324b496c605a5b2433dd8f711a0e6d747965b104d669 (AV positives: 18/53 scanned on 02/27/2016 17:18:05) File SHA256: 3101a1ef3a611d7a54257459bc81086570e77b7f66ed97961198a46c7e7d2afc (AV positives: 16/55 scanned on 02/25/2016 12:56:15) File SHA256: 0471951c10a61ff5213fbe32f85c8c2e2d2151db53fb75b3ff0713526248338f (AV positives: 38/54 scanned on 01/29/2016 05:16:34) File SHA256: 824c3e5ac38cdebcd02fa1c807477bb319263047e7958d86f528b2feb5842fb3 (AV positives: 22/55 scanned on 12/29/2015 07:20:53) File SHA256: 7e5f545b513a3308e9a882ee85317eb2b8a6a20b21e10fd81222a5d5bdb093a1 (AV positives: 7/47 scanned on 02/12/2014 00:31:46)28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAQERABERAAEAERARERAAAREBABAQAQAREREQEAABAQABABAREAAREREdEBABAQAAEAEQEBAQER4d3dARARABEBABAQAREAEaHdnQEBAAAAAAAAAAEAEQEh3x0QARAAEBAAAEAAAAEBHh2dEBEAERVURlVFVFRVREVFVEVUQAEEVAVEREVlVVVV3eIiIdEQZRYiIiIiId1dXV3d3FIgESRiIiIiIiIiIj4iIiIWIAFkIiIiIiIWViIiPdIiIeEARCIiIiIeVVViIiIiI+HgQRRiIh1WRlReI+IiIiPiIFFkYiFVVkVeIiIiHEZWIeAARCId1VVlRUZUVmRFZiHgEBRiHVVVRkRkVERFZeIh4AAUYiHVVV3VXeIiIiIj4eEBRGIh1VVeIiIiIiIiIiHhAEViIiFVVWIiIiIiIiIh4UBEYiIiFWReIiIiIiIiIeARBVYiIiHV4iIiIiIhEiHhAQRWIiIiIiIiIiIiIiIh4FEFRURFQBRVVVVVVVVQBiAQBFRERVREREVERVVVViIEAAEAEEEAAERFRUREVEQAABAAEBAAAREBAQFRABHdnRARAQABAAABAQAAARESHZ0RAQEAEAAQAQAAEAEQEiHZERAAAQAAAQEAAAEBARIh2ZAQABEAEQEQAQERAAESIZkQAQAAERAQEQEBEAEBEaAQAD///A////gP///wD///8A////AP///4B+AAAABgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAA+AAAAf/8AAH///4B////Af///wD///8A////Hw==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAQERABERAAEAERARERAAAREBABAQAQAREREQEAABAQABABAREAAREREdEBABAQAAEAEQEBAQER4d3dARARABEBABAQAREAEaHdnQEBAAAAAAAAAAEAEQEh3x0QARAAEBAAAEAAAAEBHh2dEBEAERVURlVFVFRVREVFVEVUQAEEVAVEREVlVVVV3eIiIdEQZRYiIiIiId1dXV3d3FIgESRiIiIiIiIiIj4iIiIWIAFkIiIiIiIWViIiPdIiIeEARCIiIiIeVVViIiIiI+HgQRRiIh1WRlReI+IiIiPiIFFkYiFVVkVeIiIiHEZWIeAARCId1VVlRUZUVmRFZiHgEBRiHVVVRkRkVERFZeIh4AAUYiHVVV3VXeIiIiIj4eEBRGIh1VVeIiIiIiIiIiHhAEViIiFVVWIiIiIiIiIh4UBEYiIiFWReIiIiIiIiIeARBVYiIiHV4iIiIiIhEiHhAQRWIiIiIiIiIiIiIiIh4FEFRURFQBRVVVVVVVVQBiAQBFRERVREREVERVVVViIEAAEAEEEAAERFRUREVEQAABAAEBAAAREBAQFRABHdnRARAQABAAABAQAAARESHZ0RAQEAEAAQAQAAEAEQEiHZERAAAQAAAQEAAAEBARIh2ZAQABEAEQEQAQERAAESIZkQAQAAERAQEQEBEAEBEaAQAD///A////gP///wD///8A////AP///4B+AAAABgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAA+AAAAf/8AAH///4B////Af///wD///8A////Hw==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790292737244,"unified_at":"2026-09-24T23:32:17.244Z","metadata":{"hashes":{"sha256":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9","sha1":"0c1007ba3ef9255c004ea1ef983e02efe918ee59","md5":"425e0923cf2187ffeb3947e89c9e6e57","sha512":"732e712a8a95b7270fc9e39ace0d65c95e5c927d227e14fd01c54d146fc0de06a9d8e4ea9b8ea7f6f235eb6cebb471d4e82cc576a929c9c22ce51ede30a280af","ssdeep":"1536:tj7Y9Am61nVNbjqNjfdniyeAaM8uHjD3ZnRh+9ZQ6hY48o1AZG:t5VN2imjj7FnFZ4XR","ssdeep_chunks":["1536:tj7Y9Am","1536:j7Y9Am6","1536:7Y9Am61","1536:Y9Am61n","1536:9Am61nV","1536:Am61nVN","1536:m61nVNb","1536:61nVNbj","1536:1nVNbjq","1536:nVNbjqN","1536:VNbjqNj","1536:NbjqNjf","1536:bjqNjfd","1536:jqNjfdn","1536:qNjfdni","1536:Njfdniy","1536:jfdniye","1536:fdniyeA","1536:dniyeAa","1536:niyeAaM","1536:iyeAaM8","1536:yeAaM8u","1536:eAaM8uH","1536:AaM8uHj","1536:aM8uHjD","1536:M8uHjD3","1536:8uHjD3Z","1536:uHjD3Zn","1536:HjD3ZnR","1536:jD3ZnRh","1536:D3ZnRh+","1536:3ZnRh+9","1536:ZnRh+9Z","1536:nRh+9ZQ","1536:Rh+9ZQ6","1536:h+9ZQ6h","1536:+9ZQ6hY","1536:9ZQ6hY4","1536:ZQ6hY48","1536:Q6hY48o","1536:6hY48o1","1536:hY48o1A","1536:Y48o1AZ","1536:48o1AZG","3072:tj7Y9Am","3072:j7Y9Am6","3072:7Y9Am61","3072:Y9Am61n","3072:9Am61nV","3072:Am61nVN","3072:m61nVNb","3072:61nVNbj","3072:1nVNbjq","3072:nVNbjqN","3072:VNbjqNj","3072:NbjqNjf","3072:bjqNjfd","3072:jqNjfdn","3072:qNjfdni","3072:Njfdniy","3072:jfdniye","3072:fdniyeA","3072:dniyeAa","3072:niyeAaM","3072:iyeAaM8","3072:yeAaM8u","3072:eAaM8uH","3072:AaM8uHj","3072:aM8uHjD","3072:M8uHjD3","3072:8uHjD3Z","3072:uHjD3Zn","3072:HjD3ZnR","3072:jD3ZnRh","3072:D3ZnRh+","3072:3ZnRh+9","3072:ZnRh+9Z","3072:nRh+9ZQ","3072:Rh+9ZQ6","3072:h+9ZQ6h","3072:+9ZQ6hY","3072:9ZQ6hY4","3072:ZQ6hY48","3072:Q6hY48o","3072:6hY48o1","3072:hY48o1A","3072:Y48o1AZ","3072:48o1AZG","1536:t5VN2im","1536:5VN2imj","1536:VN2imjj","1536:N2imjj7","1536:2imjj7F","1536:imjj7Fn","1536:mjj7FnF","1536:jj7FnFZ","1536:j7FnFZ4","1536:7FnFZ4X","1536:FnFZ4XR"],"imphash":"b0f4d79fba09e6820a0931b0adb49faf"},"file_info":{"file_name":"welcome to dreamland.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":131072,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288178000,"last_seen":1677397951000,"last_multi_scan":1677397951000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","spora"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":20,"suspicious_count":20,"malicious_count":15,"total":55},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Spora.tniT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.bpadj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Spora.H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.DX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Spora.H (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Spora.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Spora.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.aam","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Androm.eopcwq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Spora-AQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.Androm.131072.AM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"RANSOM_SPORA.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"RANSOM_SPORA.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.PH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Ekstak","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Spora.Win32.11","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Spora","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"malicious","value":"Creates a process using WMIC"},{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"suspicious","value":"Scanning for process managers"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00008610-00001268-00000046-13310940271","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00008610-00001268-00000046-13310940271","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"iexplore.exe\" created file \"%TEMP%\\~DFAA67D13FFF45143C.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFB0BD1F4140CEEE41.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFA3CD607131DE1E1B.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"!IECompat!Mutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"qazwsxedc\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\qazwsxedc\"\n \"\\Sessions\\1\\BaseNamedObjects\\m945811715\"\n \"m945811715\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00008605-00003920)\n Launches browser \"iexplore.exe\" (UID: 00009045-00004052)\n Launches browser \"iexplore.exe\" (UID: 00009300-00004016)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$22","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00009045-00004052) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"cmd.exe\" (UID: 00009113-00003284) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00009113-00003284) was launched with missing environment variables: \"PATH, PROCESSOR_ARCHITEW6432, PROMPT, VXDIR\"\n Process \"vssadmin.exe\" (UID: 00009120-00003252) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"iexplore.exe\" (UID: 00009300-00004016) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\", VXDIR=\"C:\\VxStream\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" on 2019-1-16.03:57:47.952","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"Progman\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" (UID: 00008605-00003920)\n Spawned process \".exe\" (UID: 00008610-00001268)\n Spawned process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /all ...\" (UID: 00009031-00003164), Spawned process \"iexplore.exe\" with commandline \"%USERPROFILE%\\Desktop\\US44E-31ZTZ-TZTXO-TOOTZ.HTML\" (UID: 00009045-00004052), Spawned process \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {d ...\" (UID: 00009113-00003284), Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00009120-00003252), Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled no\" (UID: 00009189-00002580), Spawned process \"iexplore.exe\" with commandline \"SCODEF:4052 CREDAT:275457 /prefetch:2\" (UID: 00009300-00004016)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" (UID: 00008605-00003920)\n Spawned process \".exe\" (UID: 00008610-00001268)\n Spawned process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /all ...\" (UID: 00009031-00003164), Spawned process \"iexplore.exe\" with commandline \"%USERPROFILE%\\Desktop\\US44E-31ZTZ-TZTXO-TOOTZ.HTML\" (UID: 00009045-00004052), Spawned process \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {d ...\" (UID: 00009113-00003284), Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00009120-00003252), Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled no\" (UID: 00009189-00002580), Spawned process \"iexplore.exe\" with commandline \"SCODEF:4052 CREDAT:275457 /prefetch:2\" (UID: 00009300-00004016)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$23","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$24","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"92d69010-ef8e-f6bf-db23-6d0ac5aa0e69.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00008610-00001268-00000033-13363897753\n \"WMIC.exe\" at 00009031-00003164-00000033-19042243320\n \"vssadmin.exe\" at 00009120-00003252-00000033-24583521983","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00008282-00000612-00000033-5326307646","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Scanning for process managers","description":"\".exe\" searching for class \"Progman\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-15","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.7157311874\n 7.7157311874","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"92d69010-ef8e-f6bf-db23-6d0ac5aa0e69.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.1/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WMIC.exe\" (Indicator: \"wmic.exe\")\n \"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"\" (UID: 00009031-00003164)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.bin\" claimed CRC 165998 while the actual is CRC 134838\n \"92d69010-ef8e-f6bf-db23-6d0ac5aa0e69.exe\" claimed CRC 165998 while the actual is CRC 134838","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateFileA\n GetStartupInfoA\n GetModuleFileNameA\n GetModuleHandleA\n FindWindowW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process using WMIC","description":"Process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"\" (UID: 00009031-00003164)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":5,"id":"target-23","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"\" (UID: 00009031-00003164)\n Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00009113-00003284)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/14 Antivirus vendors marked sample as malicious (35% detection rate)\n 59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"60/79 Antivirus vendors marked dropped file \"92d69010-ef8e-f6bf-db23-6d0ac5aa0e69.exe\" as malicious (classified as \"Trojan.Ransom.Spora\" with 75% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"60/79 Antivirus vendors marked spawned process \".exe\" (PID: 1268) as malicious (classified as \"Trojan.Ransom.Spora\" with 75% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$26","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.1/32\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00009120-00003252)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00008282-00000612)\n Spawned process \".exe\" (UID: 00008610-00001268)\n Spawned process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"\" (UID: 00009031-00003164)\n Spawned process \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00009113-00003284)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00009120-00003252)\n Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled no\" (UID: 00009189-00002580)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"spora.bz\"\n \"ru.wikipedia.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.88.7.60:443\"\n \"54.240.162.82:443\"\n \"186.2.161.51:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://spora.bz/,title:Spora\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"firefox.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Spora Ransomware DNS Query\" (SID: 2023728, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"\" (UID: 00019718-00002568)\n Disables startup repair \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00020136-00003112)\n Disables startup repair \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled no\" (UID: 00020260-00003284)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00020145-00003096)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":53,"imported_dlls_count":142,"dropped_files_count":0,"extracted_files_count":42,"files_written_count":345,"files_deleted_count":0,"registry_keys_created_count":13,"registry_keys_modified_count":0,"registry_keys_deleted_count":15,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":28,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware","spora"],"sample_flags":["Multi-Process","Extracted Files","User Comment","TOR analysis","Network Traffic"],"sandbox_reports":[{"id":"5c32ff6a7ca3e12f6b402a5e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Spora","submit_name":"618ddcbf-f9ef-1497-2e0d-5e7191a6822a.exe","analysis_start_time":"2019-01-16T03:55:52+00:00","indicators_count":{"informative":17,"suspicious":18,"malicious":15},"tags":["Multi-Process","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"58789f74aac2ed206f667b6c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Troj.Dropper.W32.Injector","contacted_countries":["BLZ","NLD","USA"],"submit_name":"welcome to dreamland.scr","analysis_start_time":"2017-01-13T10:36:16+00:00","indicators_count":{"informative":14,"suspicious":18,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"52.88.7.60","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"address":"54.240.162.82","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"address":"186.2.161.51","port":443,"protocol":"TCP","country":"Belize","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}],"dns_resolutions":[{"domain":"spora.bz","address":"186.2.161.51","country":"Belize","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"domain":"ru.wikipedia.org","address":"91.198.174.192","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}],"processes":[{"pid":612,"ppid":0,"name":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe","command_line":"","sha256":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9","normalized_path":"C:\\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe","uid":"00008282-00000612","icon":"$28"},{"pid":3920,"ppid":612,"name":"iexplore.exe","command_line":"","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00008282-00000612","uid":"00008605-00003920"},{"pid":1268,"ppid":612,"name":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe","command_line":"","sha256":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9","normalized_path":"C:\\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe","parent_uid":"00008282-00000612","uid":"00008610-00001268"},{"pid":3164,"ppid":1268,"name":"WMIC.exe","command_line":"process call create \"cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00008610-00001268","uid":"00009031-00003164"},{"pid":4052,"ppid":1268,"name":"iexplore.exe","command_line":"%USERPROFILE%\\Desktop\\US44E-31ZTZ-TZTXO-TOOTZ.HTML","sha256":"58ac3fef55e35bffc0319f37434bda136ae506ec4a984dbb5fe1b7f24852a16e","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00008610-00001268","uid":"00009045-00004052"},{"pid":4016,"ppid":4052,"name":"iexplore.exe","command_line":"SCODEF:4052 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00009045-00004052","uid":"00009300-00004016"},{"pid":3284,"ppid":0,"name":"cmd.exe","command_line":"/c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00009113-00003284","icon":"$29"},{"pid":3252,"ppid":3284,"name":"vssadmin.exe","command_line":"delete shadows /all /quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00009113-00003284","uid":"00009120-00003252"},{"pid":2580,"ppid":3284,"name":"bcdedit.exe","command_line":"/set {default} recoveryenabled no","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00009113-00003284","uid":"00009189-00002580"}],"all_imported_dlls":["jscript9.dll","oleaccrc.dll","vss_ps.dll","mfc42.dll","cryptsp.dll","nsi.dll","drprov.dll","Wldap32.dll","WindowsCodecs.dll","deploy.dll","imm32.dll","profapi.dll","crypt32.dll","winbrand.dll","ntdll.dll","urlmon.dll","mswsock.dll","netapi32.dll","msvcrt.dll","netutils.dll","comdlg32.dll","lpk.dll","normaliz.dll","VxSSL64.dll","api-ms-win-downlevel-version-l1-1-0.dll","RpcRtRemote.dll","dhcpcsvc6.dll","apphelp.dll","winsta.dll","ieproxy.dll","dhcpcsvc.dll","sxs.dll","api-ms-win-downlevel-user32-l1-1-0.dll","clbcatq.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","mlang.dll","bcrypt.dll","vssapi.dll","comctl32.dll","davclnt.dll","URLREDIR.DLL","bcryptprimitives.dll","uxtheme.dll","sechost.dll","msctf.dll","wow64win.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","dxgi.dll","oleacc.dll","MSOHEV.DLL","rpcrt4.dll","dwmapi.dll","wintrust.dll","jp2ssv.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ntmarta.dll","nlaapi.dll","dui70.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rpcss.dll","dnsapi.dll","cryptbase.dll","ole32.dll","IEShims.dll","srvcli.dll","WSHTCPIP.DLL","wow64cpu.dll","iertutil.dll","ntlanman.dll","cscapi.dll","browcli.dll","shlwapi.dll","mshtml.dll","davhlpr.dll","npmproxy.dll","user32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","d3d10warp.dll","GROOVEEX.DLL","framedynos.dll","ieui.dll","winnsi.dll","d2d1.dll","msxml3r.dll","wbemsvc.dll","netprofm.dll","rasadhlp.dll","odbc32.dll","sspicli.dll","ATL90.dll","wbemprox.dll","xmllite.dll","odbcint.dll","wow64.dll","rsaenh.dll","version.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wtsapi32.dll","ExplorerFrame.dll","fastprox.dll","ntdsapi.dll","MSOXMLMF.DLL","ssv.dll","imagehlp.dll","atl.dll","d3d11.dll","devobj.dll","wkscli.dll","gdi32.dll","ieframe.dll","propsys.dll","cfgmgr32.dll","msvcp90.dll","sqmapi.dll","wship6.dll","duser.dll","usp10.dll","shell32.dll","psapi.dll","msimtf.dll","setupapi.dll","wbemcomn.dll","webio.dll","msimg32.dll","KernelBase.dll","DWrite.dll","mpr.dll","winhttp.dll","msxml3.dll","oleaut32.dll","kernel32.dll","advapi32.dll","userenv.dll","secur32.dll","msasn1.dll","IPHLPAPI.DLL","msvcr90.dll","vsstrace.dll","msvcr100.dll","wininet.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ws2_32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"92d69010-ef8e-f6bf-db23-6d0ac5aa0e69.exe","sha256":"e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"945811715","sha256":"984c3072fc0610ed89febda9c2dfc274ca0b81d7e1241f37a208ad847831bf65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"~DFA3CD607131DE1E1B.TMP","sha256":"6785a86738850e47a302aec0059542216c7d30920ecee2d90b8cc10effade603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"~DFAA67D13FFF45143C.TMP","sha256":"eb02149e93b54b26939dbee91ea22113242c82b8280d8cd213a2712bc1a180c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"~DFB0BD1F4140CEEE41.TMP","sha256":"821898ff4b89e024a5ee3da887a096973eab692e68f32a2d2d3926acd01cc83a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Windows.lnk","sha256":"d1ad0eaba85d3d11654a33796bc46a66d83ee9a7196b269b551e1d54ec6d4d3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"PerfLogs.lnk","sha256":"cf3d5a30732ca377c8729c8b839650cf824c52b8b302b1a881ab63eae34765e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"setuppackages.lnk","sha256":"a1d64ec13a49d757c2c9bf4d6c2312c5567b3edae5320c084b77f5728b5f9693","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Program Files.lnk","sha256":"fa077d021e127783478c1e373d818af3cee327565d4e59b261c708f9f9bb07e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"Program Files _x86_.lnk","sha256":"de941a9754f5693d80d0ba6f69f2ffd58b395c501d12b9a9f1bceed7b5ab7544","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Users.lnk","sha256":"2bad98ac5e50a9f922a82e038063b2fca8ff938b9229d6fe914f5545788e0ad5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"Tulips.jpg","sha256":"b9395622696f933870925aead7aaabba6ff5a1903ba8d0599ffd6a30fb91ac9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"GreenBubbles.jpg","sha256":"9bc8fc7d1b6c556f0186915cbbf20dba6d6f9be02f6ffcc978f7fb529c2e9067","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"_684A0AD5-193A-11E9-9FD4-0A002709B68F_.dat","sha256":"d099664f4ea05e2c8538dc31c6a58f82faa823ee03d88334d6be0e02d701ccff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Jellyfish.jpg","sha256":"9cea01dc321e86c9774638710cb204580d27e7b38e50e3a95e303ab127079b3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Bears.jpg","sha256":"7be75151482ea0fae3cc79f804d8046ca59096dfc80348115b039d4922d74aeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Pine_Lumber.jpg","sha256":"88e461613a1d191e34b5b3ed982bdf986f34775539257118724fe69d28d42aa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Stars.jpg","sha256":"aad585d365932ef2f8201d537c1d65d689bb19d2f7bbdb11f2f0506a0387502f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Garden.jpg","sha256":"db5b6516ddc8731ef4b1e415f9685b744af9adbc22f6a316f19e845e6fe3b216","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"MLABNPTBJ1PKHUIHQVJ8.temp","sha256":"c515ab304c6737f0456aac0e3e24062323ddb9b32a812d1870ad706df367bc34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"WATI9BP0AK9C3YZ1Z35U.temp","sha256":"c515ab304c6737f0456aac0e3e24062323ddb9b32a812d1870ad706df367bc34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"616740512","sha256":"7da5843c9a350c1a9edec5daf5afdeed5896af78b2dc3cb7a1a5603a58ce9c2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"6AFKQ6AMNL4QBNG2NQXS.temp","sha256":"d1220e9e25f93881aad3c7ae0017606ef6bb602f66c20ad352e50e9d3567d6d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"6KVCKBRMGBUPQCLIP9AQ.temp","sha256":"d1220e9e25f93881aad3c7ae0017606ef6bb602f66c20ad352e50e9d3567d6d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"cert8.db","sha256":"29b78a90880135c39e40c379166e534b04d2c4f8145dcea9a9233889525472fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"content-prefs.sqlite","sha256":"8a2b8e4573361e66b5426d65811947157e97201075b3cca01077626ffa1270bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"content-prefs.sqlite-journal","sha256":"d04aab2a5d31adb3f4af9135a3fe71edfb796f073fe695c0d9c44bb68db55b31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"cookies.sqlite","sha256":"98764c9fc64002116d0a9b99e248d973501499844345952bbb98f516c9133188","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"cookies.sqlite-journal","sha256":"373984e71cd64ae1844e4603b0d211ef5f418bccea8b1a9b2052053ed8ed92cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"cookies.sqlite-wal","sha256":"613884a4a3fdc04dbe52933ab517f584fb9b627b94692879e6857cf23102f30f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"store.json.mozlz4.tmp","sha256":"078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"gmpopenh264.info","sha256":"ac5630d4ee33fee680fce34437625b29435a3e2472393eda86c27f05df36ad05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"healthreport.sqlite","sha256":"f63cb4857c4788196f3fa25708764057be41a728b402ccbc6fa410ddfa1b3a6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"state.json.tmp","sha256":"dd26c177bb2f6447a71073fbfd214e2e3f96c79a10ebc39d9ff9114d4aa1208a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"permissions.sqlite","sha256":"7c1688807dce2a1461e5975390f5374c771765cee943cf6e9aea04cc01e75865","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"places.sqlite","sha256":"8d1063b75a43849216526106ca6e2366e027e98d7bf7d8bb035ca3662b5aab69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"places.sqlite-journal","sha256":"3b12b5cf7010d1770edd02c55fbef94e24e9ce256da66e547b0959b5a95e7113","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"places.sqlite-wal","sha256":"cff04c1acf84c6387fc920d562095611b11757033851cdfacccc962b404ebd23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"prefs-1.js","sha256":"f34a6d727642d3885535f98c495046c24762de1df2f99f4f8246db603908df56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"uCEsGrB9.lnk","sha256":"3f93e48c9d76896584cdbc4938099633b0028e3c84bf91b4fcef6833b74d0568","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"0kg6z.lnk","sha256":"f3aae76093605a0e22d1a30f51867c92d06f2fca2f3a862cda9301dff3f3de0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"7599t5eO.lnk","sha256":"44417fa07d58af88467941601431de796ee25080813f05c6f270ea95e0238ef5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}],"files_written":[{"path":"C:\\myapp.exe","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\CSIDL_X","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.exe","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"C:\\e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9.ex_","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\CSIDL_","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\MFC42.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\945811715","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{684A0AD5-193A-11E9-9FD4-0A002709B68F}.dat","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%TEMP%\\~DFAA67D13FFF45143C.TMP","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%USERPROFILE%\\Desktop\\US44E-31ZTZ-TZTXO-TOOTZ.HTML","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{684A0AD3-193A-11E9-9FD4-0A002709B68F}.dat","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%TEMP%\\~DFB0BD1F4140CEEE41.TMP","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash64_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AJM3J0V2.txt","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{9F7ABA2E-193A-11E9-9FD4-0A002709B68F}.dat","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%TEMP%\\~DFA3CD607131DE1E1B.TMP","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OF7AE8LS.txt","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\welcome to dreamland.scr.ex_","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\welcome to dreamland.scr.exe","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\616740512","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\dependentlibs.list","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\MSVCR100.dll","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\MSVCP100.dll","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\InstallTime20150122214805","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\parent.lock","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\compatibility.ini","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\omni.ja","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\omni.ja","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\wbem\\XSL-Mappings.xml","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\mozilla-build\\msys\\local\\lib\\icu\\icuplugins52.txt","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\chrome.manifest","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\defaults\\pref\\channel-prefs.js","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\chrome.manifest","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\components\\components.manifest","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\startupCache","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\user.js","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\extensions.ini","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\chrome.manifest","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\A0U7KZ~1.DEF\\secmod.db","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\A0U7KZ~1.DEF\\key3.db","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\SiteSecurityServiceState.txt","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\update.status","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\00FB7E835F7E9D8EA3C91E10ACAEBC3CBEB6F319","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\03E27938A4BD55FAABCC8F86F76523107C32F096","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0465F1BE81842BF190E758CDCD7D7F7624ECA2E4","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\04F4E02F65ED8630D7BC592B6D36376DF46FCD72","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\05226AC7374E745CB49D655CEBBB42B7D43D2C65","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\05DC37A0E58ED2C012FF4DB75EFEA673B4B62911","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\06CCDA09A7CD309D452F564A366677EFFA261BF6","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0CADC78C46BE7A5612780FC958D945A6B80DE4AF","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0D6A463CA85FBEB41A8ED88BDB87527AF5F08633","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0E04B803C3E03DCC860947A7CC7909866FAAAE72","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0E1AA0B656DFD7D8E2E0F591C6FBECE42B260C44","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\0E88A8084D97F063E51EDF49ACDD3F482D758767","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\105D3A9432C01FB6F8166B336A22A16EC9BD32F9","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1242184E2E0877DC23765B2E94120EF39ECB2FA7","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\129518677723B0A053599EE4A18409F4097A74D8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1974E1FA52908FE2C537708B973C70F1059495C3","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1B1D639857BDB036BC82E5FA867F24B47E07F3DD","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1ED22E6023DE3861DF916105B08793703EA187BA","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1EE4BA35A23C3C40FEB400CED3A71B574E426753","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1F7512783D6579EE374646C3966BE1339A171863","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\1F94FF97F14F7069A0281E9DD371D85853F633B1","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\21A823D16A76262B80CA174B01EABF58B09603A5","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2225C11E0A4957C3CCE034FC178F517B3B8BBFCC","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\25DFD13EC574514F96A829EB97492CDC40882F50","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2A57B8B6746E10488C5DA17729B4B9DC68B590DE","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2D54F056066AFCB773375626114E4FE638CA851E","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2E0C4058E084A83FFD5E59DF25634B4708213893","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2E3AA54756007309B4045F5A901E712F2CD08C7F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2EC7F0910BAF664518D0D625A8CDE292D53D2E97","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2F2D5C85951F8DD45C5EE29DCAB3EFFADB02DAD0","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2F7AA022C3033A49733E4ACACB790B0AEA33EE06","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\2FFB54B8BC074FD0461F56092C885213BD24DDFF","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\permissions.sqlite","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\30088D5D85648DB1D8C4B6BD16379983DD45F675","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\301AC4A68A1B88E805A8B43E846F037D3AEA2138","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\30FD3153020EC77A1653849D46E42E0B4006C633","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\32E847CBC2079ACB3110B7EBA72E543D4F0D1C68","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\352FFEDD2461749BC5A2B2281CBCDBD97361D5A8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\353B172F0EAF86EFA9203B76EC8BAECD317F6F6F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\370E8064FD17CBCCAE8437A1885B7DCF9B6E0B12","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\371BD8867654493BF84E4D7444C89957753D3613","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3880321EFEC4B670DBEF674079F6D91C515BC7FF","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3CBA8E27010FAB192E82890AA7F8FC12B88F0AD8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3DD95C5B94B60B8EAC8D15C50B4DE3EF45A9D2A8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\3EED435B3241E216CAE28B301DFDDB3718BBDFF0","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\40B3EA222D2040213EB24EF69944B5F903CF34B5","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\434B22F05630088EC7BC33A1723255BBF9579E5F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\447A80CE277350756F838E0A8161628BED64CF78","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\474B042F28F7096D3A3E1782368560B58A64CE57","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\48AD1F20753B6AE0CBF91C027BB14E84FA90A0F0","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\48C1474958A4DE1F1C13E433352B9CCDDB3510D0","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4972A306778C47F464CD59D7AD7BDF15C05CA36E","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4C5BA9BC62328203ABA3C351469D46DE8C262D63","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite.corrupt","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4ECB89424430E2F2E55082743FAE5F80053C7437","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4F6AEE0B2336FC2D32934E5A0D1363A7C229C7CC","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\4FEF67DB9162C4577485CC3B2E848ABE708A8A6C","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\51F1D2C71B78BF7ECCBCC4E4084E50213562B51B","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\52C0C1A51470FC7CA19F7465313DA4FF48BFA363","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\533880D31FD5327CA77924436876812BC8F3D7E9","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5429450E2E294B8E09159087D4A501B12FFEC93E","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5485C935CC30BC107CA333E40B0139C57BCDAB12","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\555828B93E32D75FABFE0BACD99384ED715DCC85","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\57E9D595061288F3914C46A0D0EFDC239404553F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\590907C9A33CF61DBC08F99143DCEE1C1119751A","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5AC565FD91A0D787A771C2B23CEDC0AA77BEFD7C","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\5FAC2B51FD76043D24AF5FE3A0042094F9402CD2","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\638E2612BBEBE3B29274D8A7D8E048124FB05080","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\676ADB2097AAFE4CA0B991D27193308C0E35EF1B","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\67EDA5829C6ECDFC340C5D6FFF732E9EC1286D8A","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\681F82A39945572A06375C7584B5C2718F76072C","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\69992ACAF5F252D9AAE87D1E83837B752B665C5F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\6DF4C247EB188DBE3AA7FEFB8B83F5C21339C17F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\6F8FB4D82C35910ECF7AB512D58576D942963BA4","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\704FDD0ADBE88879909251B18BCDA324E5C0C6FF","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\708FF29D7D9CBC05733F334E3C64555866512C03","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\73460A701FF1F49FAD2A187BFF88ACD24D73DC22","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\76797554FCFEF85503E570F4FBE5ACC09B95DAC2","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7AC434CD10C735364DFC8BF9AC210FC86607D419","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7C1F728C888643340F6BFF77FCFCC33956677562","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7E766EFF450C1A09D1BE673F808C44C1DC716CF5","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7ECF1B7C23F6650D0A553829D9F753FE0A072515","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\7F12A27AC17BC481D93CD9C0AE94CB8148A1FA0D","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\817E4769CDAE452B81442549D2F9968F739715A8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\81A6829B07CED4AAA179B90710FA7E1CAF865703","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite-shm","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8289505E777C3ACDC40F8CA2492B08006C5861E8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8321793CE0669F6623B650DC53CFC5C3401E64C2","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8570BAC7E9E80CD01BB4F3C1A7F318E45CDA7494","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\87D21E588A758F55C79B1A80AF53F5DE8F97BD07","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8857F3033ADD4EB28817638302A934EFC707BBDC","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8B2F1DA32829D8FA2C7D3870B22BA5121A24A273","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8C0FDCA4DC1D3CC4A01D5AECDB6033424805BA4C","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8D2EAF9A088E2EE4277C2E297CFC26C1D6377041","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\8D5C460ADDC2F1F7EE333834D1754B11BAE09C21","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\90315B08C7EA5741C86D44F3C1B5420F168BAC3F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9097930649FE7A5ED5C370E284F3159B56458EFF","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9276FE696600CB50F895AE7C9174CFCFFE07D923","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\92A3C973FACB33FF0162AF2202B1ABF0428228FA","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\931F4A22FACB88129776074AAF555C2C5A045EE4","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\94819098B9D2C4279A6112A11E3358BE68580958","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\95E30605786E73CC205725268CB638D76F46E4F2","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\95EA667D4D2DE43B5E8CEEE88E517AAA028F72EC","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\96BC283800385EA51B5A0C9CA8055A144AEBF24A","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\97B8276E1B45E6C0C01BFE8C091D416310B3D7FB","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite-wal","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\996FF69B28B46AA08240D5B033726E178EA73F53","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9A07B5BA4FDCEED8E6D42A3C90768F04B2A9C8AE","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\9EE02001B4F4CADACC54DF5B2E91317FB81ADAEA","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\A350F82A64F2880D28FB1921E92057E4A610BFD1","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\A5AE7C975DF0B182D35B945F55504D011B8004D0","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\A6158820868096C47EA71CED39728F941D77E6D5","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\AA5588C93D95518EF899D6C5A9FE354E92238BCD","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\B053E3AD2CAA0768C4EB7584A171C603331CD93A","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\B20BF410AEE199A12708CA21DABF65AD2AE2BCF8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\B9403F5B1405E5000246F2AC6EF5A6886E312511","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BB1913A2380BABE37897EA2B94E177C717530A5B","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BB7456C8D68B3D4A2EB2E4554D63E2CFE4EEC90D","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BC20A45B3DCD784841C1D1DB98F042F71D4A5C25","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BC84AA1DE91E102FE8821F76E4D3382C5478F8C8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BCA3931218FA68066E7D851877F37B14DE8B2E93","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\BEBEE734DC8E94FA255A22C5E3CA667757BE30D8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\C094437F984D96F2D01C36CFABCBF9CA4F2EBBA6","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\C304A01B70FA48AFE3DC36261831A7526B04A80C","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\C8BE3BBD215F0457C0AF18601EB2AB9102D9DD08","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CADE55E969FAEEC35F2A22A08F146E1965C33911","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CB05A88751F6B2B79CA839255A4890B427F23AA1","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CBEC613E5CFAB507A1C654E90F59982CE8EAC680","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CC5383081CDB993E393091792FFE88CDD5D0C4D5","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\CE95114622634B41823E2186167B85810C065D80","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D057BD0D21CBA6CDCECA79A5F78A0163EF348BC6","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D1DD34E8641EA828676BD98C89DC0434EF10B0F8","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D36FD0721F11A7AE28A82198D72211B81B3A7CD3","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D37A5F8E64C609CDEBE714E3412E8AF88334504E","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D42FD60FBF95B9FE1D02FB6197FF24B81AE234D1","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D44BD2282850C5677731142E8E41A4715B1D2173","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D617B4A50D4DF9418CC46991A46B46457FA08387","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\D8DF957C2A0EDB79F6B0B7FCCAF8A1BD1021C282","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DB2012FA1EEB48278BE39A073A4C19541807393D","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DB83FC691E21BC77F6D161A9BD5015D7D63E2BB4","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DC1863701DE3B4BF3A49F4CA7C2389E27D26955F","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DDE05E6CD4B04C1396A7C1C978F92FA7B82DC8E1","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DE6F2EA50E4D5FE5ACB8C8C33CE12306F6A1685D","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DF8288208B71302823466AFC0C55FC462241566C","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DFA43D30A714AA169350273B86EAF29F625A85DD","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\DFD1C2C4553F5E655521E5BE8AB71DCA244318F7","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E071FB500DBE3B8E9C2DB2464A7B5E090139BBF9","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\content-prefs.sqlite.corrupt","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E1884D9BEBEF9545BC8C8F00719085B071C60582","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E190DB789DC1C308BBF565F2277C09949CB02650","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E245013D019AE596820CB52129E842FBD0054F1E","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E325B486B777C14C29762600D998974140F8FD34","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\E6913B75D6EEB6FE59DCD485FC9C54BB751E4061","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\EC704D06E5277E22B5179F13A1761CB068985AAC","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\EF31F4F06DBFD9469F03AA2C92191DFB5075F65A","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\EF6776722884E7D4E225C23DC9E5605501416DEC","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\F277DBFB73069EA798E618645936AA6A1B8AD356","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\F4289F4DB3103AA2D9EEACDEA4B88CF78B9D8F1B","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\FC1ACC47459A1C5DDEB33199E979D2351D3913F0","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cache2\\entries\\FE582363364A5991E97E5ACBE5B585AACB9A6DF2","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\content-prefs.sqlite","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionCheckpoints.json","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cookies.sqlite","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\en-US\\WININET.dll.mui","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\webapps.json","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"C:\\Users\\8nhmTxt","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\system32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\xulstore.json","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%LOCALAPPDATA%\\Mozilla\\updates","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%USERPROFILE%\\Desktop\\USEFA-0FZTZ-TZTXF-THZTZ.HTML","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\mimeTypes.rdf","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionCheckpoints.json.tmp","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore.js","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\events","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\bookmarkbackups","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\search-metadata.json","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\signedInUser.json","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\state.json","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\blocklist.xml","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\search.json","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\BLC\\","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\BLC\\RECENT FILE LIST\\","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\BLC\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKLM\\SOFTWARE\\REGISTEREDAPPLICATIONS\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTML\\OPENWITHLIST\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{258F88E9-A174-4F3C-B4AB-21CA49500B5A}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SQM\\FREEZEUPLOADS\\HIGHTIME\\HIGHTIME","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SQM\\FREEZEUPLOADS\\LOWTIME\\LOWTIME","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"},{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"qazwsxedc","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\qazwsxedc","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\m945811715","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"m945811715","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"IsoScope_fd4_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"IsoScope_fd4_ConnHashTable<4052>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"IsoScope_fd4_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"IsoScope_fd4_IE_EarlyTabStart_0xfd0_Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_4052","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_4052","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_fd4_IE_EarlyTabStart_0xfd0_Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_fd4_ConnHashTable<4052>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_fd4_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_fd4_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_fd4_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"IsoScope_fd4_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c32ff6a7ca3e12f6b402a5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\m616740512","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8nhmtxt!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8nhmtxt!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8nhmtxt!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\FirefoxStartupMutex","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MozillaUpdateMutex-aeVcDEW6vlSu+PLYtSFCvWhPsG0=","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"58789f74aac2ed206f667b6c"}]}]}},"report_ids":{"sandbox_job_ids":["5c32ff6a7ca3e12f6b402a5e","58789f74aac2ed206f667b6c"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Ransom.Spora Sample e3af61658332… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e3af61658332…. Malware family: Trojan.Ransom.Spora. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Spora Sample e3af61658332… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e3af61658332…. Malware family: Trojan.Ransom.Spora. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e3af616583327f189f2d9e0b1c38199e1f35dda391b6a559253be0fb4410a0e9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Spora Sample e3af61658332… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e3af61658332…. Malware family: Trojan.Ransom.Spora. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]