ID: Cookbook: browseurl.jbs Time: 18:33:33 Date: 06/04/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 18:33:33 Date: 06/04/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: System Summary: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Statistics Behavior Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 System Behavior Analysis iexplore.exe PID: 3728 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3792 Parent PID: 3728 General File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 416

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 18:33:33 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 7m 58s light browseurl.jbs 21ee /6f9d2976f69cdf1ec152cfcc 7d66e036/e6b d27ffd99d516fd374e079 5/app.smartsheet.com/b/home?tg=explore&u tm_source=marketo&utm_medium= &utm_c ampaign=newsletter&mem=button&mkt_tok=ey JpIjoiTlRoak9EQmhORFUyTW1JdyIsInQiOiJPS1 hcl0dndstszjzwd2nfvdjqoxn6tfhc RXYwdHRYMVNpcEJxcjg4N2E5VGdRa0Q4RGhoeTVt R0w5a2FBcW5cL2xWd1BjcXhxQlQzUFIyeHQreFdq dhltrgjkddczuytic0c5bgxrbgdnkzcyythjr3lo Nm5nTWZBUlVPTTlBcXR4In0%3D Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal52.phis.troj.win@3/275@65/34 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Adjust boot time Correcting counters for adjusted boot time Browsing link: tg=explore&mem=button&utm_campaign =newsletter&utm_medium=ema il&mkt_tok=eyjpijoitlroak9 EQmhORFUyTW1JdyIsInQiOiJPS1hcL 0dNdStsZjZwd2NFVDJQOXN6TFhCRXY wdhrymvnpcejxcjg4n2e5vgdra0q4r GhoeTVtR0w5a2FBcW5cL2xWd1BjcXh xqlqzufiyehqrefdqdhltrgjkddczu ytic0c5bgxrbgdnkzcyythjr3lonm5 ntwzbulvpttlbcxr4in0%3d&ut m_source=marketo Real link is: tg=explore&am p;mem=button&utm_campaign= newsletter&utm_medium=emai l&mkt_tok=eyjpijoitlroak9e QmhORFUyTW1JdyIsInQiOiJPS1hcL0 dndstszjzwd2nfvdjqoxn6tfhcrxyw dhrymvnpcejxcjg4n2e5vgdra0q4rg hoetvtr0w5a2fbcw5cl2xwd1bjcxhx QlQzUFIyeHQreFdqdHlTRGJKdDczUy tic0c5bgxrbgdnkzcyythjr3lonm5n TWZBUlVPTTlBcXR4In0%3D&utm _source=marketo Browsing link: Copyright Joe Security LLC 2018 Page 4 of 416 Failed Failed

5 rtsheet.com/b/oauth2login?form Name=fn_oauth2login&formAc tion=fa_logingoogle&tg=exp lore&utm_source=marketo&am p;utm_medium= &utm_cam paign=newsletter&mem=butto n&mkt_tok=eyjpijoitlroak9e QmhORFUyTW1JdyIsInQiOiJPS1hcL0 dndstszjzwd2nfvdjqoxn6tfhcrxyw dhrymvnpcejxcjg4n2e5vgdra0q4rg hoetvtr0w5a2fbcw5cl2xwd1bjcxhx QlQzUFIyeHQreFdqdHlTRGJKdDczUy tic0c5bgxrbgdnkzcyythjr3lonm5n TWZBUlVPTTlBcXR4In0%3D&sua=home Real link is: client_id= ap ps.googleusercontent.com&a s=3s7g18sjofwdwl16nxa3ra&d estination=https%3a%2f%2fapp.s martsheet.com&approval_sta te=!chroz002og9iderkcu1iu0pmvz NkVhIfczlkTGVSM1VCSFlZY0t0V0xt Y192ZHFZRXZtOEtSWQ%E2%88%99AB8 ihbuaaaaawsjzlp-0lfosek5b4subtcdxkqwerh4&xsrfsig=ahgife _ebeijfwyep6mio8solnbtmv5osa&a mp;fname=generaloauthf Browsing link: rtsheet.com/b/azurelogin?tg=ex plore&utm_source=marketo&a mp;utm_medium= &utm_ca mpaign=newsletter&mem=butt on&mkt_tok=eyjpijoitlroak9 EQmhORFUyTW1JdyIsInQiOiJPS1hcL 0dNdStsZjZwd2NFVDJQOXN6TFhCRXY wdhrymvnpcejxcjg4n2e5vgdra0q4r GhoeTVtR0w5a2FBcW5cL2xWd1BjcXh xqlqzufiyehqrefdqdhltrgjkddczu ytic0c5bgxrbgdnkzcyythjr3lonm5 ntwzbulvpttlbcxr4in0%3d&sua=home Real link is: crosoftonline.com/common/oauth2/authorize? response_type=id_t oken+code&client_id=3290e3f7-d3ac bcef-cf4874fc4270 &scope=user.read&respo nse_mode=form_post&resourc e=https%3a%2f%2fgraph.windows. net&redirect_uri=https%3a% 2F%2Fapp.smartsheet.com%2Fb%2F azure&nonce=eyj0ijo0mcwibc I6ImV6SzdCM2I2My1KQVYxZTZ3V2pW Y1JQaTM5RHdXZG9sZDhsMHl6bVJNUm 9B%0AR3dGeVhPSTNtUTBoOFhEMENsS VMiLCJyIjp7InRnIjoiZXhwbG9yZSI sim1lbsi6imj1dhrvbiis%0ainv0bv 9jYW1wYWlnbiI6Im5ld3NsZXR0ZXIi LCJ1dG1fbWVkaXVtIjoiZW1haWwiLC Jta3RfdG9r%0AIjoiZXlKcElqb2lUb FJvYWs5RVFtaE9SRlV5VFcxSmR5SXN JblFpT2lKUFMxaGNMMGROZFN0c1pq% 0AWndkMk5GVkRKUU9YTjZURmhDUlhZ d2riullnvk5wy0vkegnqzzromku1vk dkumewutrsr2hvzvrw%0adfiwdzvhm kzcy1c1y0wyefdkmujqy1hoeffsuxp VRkl5ZUhRcmVGZHFkSGxUUkdKS2REY 3pVeXRJ%0AYzBjNWJHeHJiR2RuS3pj evluagpsm2xvtm01blrxwkjvbfzqvf RsQmNYUjRJbjA9Iiwic3VhIjoi%0Aa G9tZSIsInV0bV9zb3VyY2UiOiJtYXJrZXRvIn19 Browsing link: rtsheet.com/b/signup?tg=explor e&mem=button&utm_campa ign=newsletter&utm_medium= &mkt_tok=eyjpijoitlro ak9eqmhorfuytw1jdyisinqioijps1 hcl0dndstszjzwd2nfvdjqoxn6tfhc RXYwdHRYMVNpcEJxcjg4N2E5VGdRa0 Q4RGhoeTVtR0w5a2FBcW5cL2xWd1Bj cxhxqlqzufiyehqrefdqdhltrgjkdd czuytic0c5bgxrbgdnkzcyythjr3lo Nm5nTWZBUlVPTTlBcXR4In0%3D&amp ;utm_source=marketo Real link is: tg=explore&mem=button&utm_campai gn=newsletter&utm_medium=e mail&mkt_tok=eyjpijoitlroa k9eqmhorfuytw1jdyisinqioijps1h cl0dndstszjzwd2nfvdjqoxn6tfhcr Copyright Joe Security LLC 2018 Page 5 of 416

6 XYwdHRYMVNpcEJxcjg4N2E5VGdRa0Q 4RGhoeTVtR0w5a2FBcW5cL2xWd1Bjc XhxQlQzUFIyeHQreFdqdHlTRGJKdDc zuytic0c5bgxrbgdnkzcyythjr3lon m5ntwzbulvpttlbcxr4in0%3d& utm_source=marketo Browsing link: Real link is: tsheet.com/legal/privacy Browsing link: rtsheet.com/intellectual-property/ Real link is: tsheet.com/legal/privacy Warnings: Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3792 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 6 of 416

7 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking System Summary Copyright Joe Security LLC 2018 Page 7 of 416

8 Click to jump to signature section Phishing: HTML body contains number of good links Phishing site detected (based on logo template match) Found iframes HTML title does not match URL META author tag missing META copyright tag missing Networking: May check the online IP address of the machine Connects to many different domains Social media urls found in memory data Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Classification label Creates files inside the user directory Creates temporary files Reads ini files Spawns processes Uses an in-process (OLE) Automation server Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Behavior Graph Copyright Joe Security LLC 2018 Page 8 of 416

9 Behavior Graph ID: URL: Startdate: 06/04/2018 Architecture: WINDOWS Score: 52 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend Number of created Registry Values HTML body contains number of good links May check the online IP address of the machine Phishing site detected (based on logo template match) started Number of created Files Visual Basic Delphi iexplore.exe Java.Net C# or VB.NET C, C++ or other language Is malicious started iexplore.exe munchkin.marketo.net geoip-js.maxmind.com , 443, 49310, SOFTLAYER-SoftLayerTechnologiesIncUS United States 41 other IPs or domains May check the online IP address of the machine Simulations Behavior and APIs Time Type Description 18:34:22 API Interceptor 1496x Sleep call for process: iexplore.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link crl.rootca1.amazontrust.com 0% virustotal Browse o.ss2.us 0% virustotal Browse munchkin.marketo.net 0% virustotal Browse Copyright Joe Security LLC 2018 Page 9 of 416

10 Detection Scanner Label Link app.smartsheet.com 0% virustotal Browse t.yesware.com 1% virustotal Browse s.smartsheet.com 0% virustotal Browse login.windows.net 0% virustotal Browse crl.rootg2.amazontrust.com 0% virustotal Browse js.maxmind.com 0% virustotal Browse 0% virustotal Browse 464-onm-149.mktoresp.com 0% virustotal Browse stats.g.doubleclick.net 0% virustotal Browse crl.godaddy.com 0% virustotal Browse log.optimizely.com 0% virustotal Browse ocsp.rootca1.amazontrust.com 0% virustotal Browse 8phvz2leo7.execute-api.us-east-1.amazonaws.com 0% virustotal Browse cdn.optimizely.com 0% virustotal Browse 0% virustotal Browse clients1.google.com 0% virustotal Browse d2myx53yhj7u4b.cloudfront.net 0% virustotal Browse ssl.gstatic.com 1% virustotal Browse crl.pki.goog 0% virustotal Browse bam.nr-data.net 0% virustotal Browse x.ss2.us 0% virustotal Browse 0% virustotal Browse s.ss2.us 0% virustotal Browse ocsp.rootg2.amazontrust.com 0% virustotal Browse accounts.google.com 1% virustotal Browse geoip-js.maxmind.com 0% virustotal Browse secure.aadcdn.microsoftonline-p.com 0% virustotal Browse 1% virustotal Browse fonts.googleapis.com 0% virustotal Browse ocsp.pki.goog 0% virustotal Browse login.microsoftonline.com 1% virustotal Browse logx.optimizely.com 0% virustotal Browse 0% virustotal Browse cdn3.optimizely.com 0% virustotal Browse pki.google.com 0% virustotal Browse js-agent.newrelic.com 0% virustotal Browse fonts.gstatic.com 0% virustotal Browse accounts.youtube.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Copyright Joe Security LLC 2018 Page 10 of 416

11 Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 11 of 416

12 Startup System is w7 iexplore.exe (PID: 3728 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3792 cmdline: '' SCODEF:3728 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) cleanup Created / dropped Files C:\Users\SAMTAR~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): D7B3927BC874C8F0CD751C8579ADD2 1D451B33DB2BC44A84F52C0CE BAB47 A6808C0B6E B0F0CBB56B3F589DAE595155F12BCB774DCC018C82AA308 A3CA630580AFF820FCD9C2409C46A BDF94F66CBC21D73733E8799D1003FBB9624D F40544AF0288 F0004DB30AC416ECBD8A520B98F20E929C6A C:\Users\SAMTAR~1\AppData\Local\Temp\~DF288402B4F96BD2CB.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): CBF6D C943E7E200061EB D44A0632A3EEC8BC44C6CBD1532D1A93DA131A61 489F461F1CA C714863ED96355DD23866D06B A2DE14EF 6E2F33D34BFD A8FFB89931AE EFB377A9A861D5C86B4B05EF7973E72AABA932D120B3685A8 ECBD C60E1AC63C6943D98F96C8B0 C:\Users\SAMTAR~1\AppData\Local\Temp\~DF4CF8A5539DCBB2B1.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): A4FE3310D8AC2ADB78CEE17E2FDE8248 0C33C0E919D76A45066EF C63F4646B3 9D6B DE2CDDEAA3F751A92EC3D5DB993FC4E94523F C3765B4F E6867BC AD5F7D6BDE DA91C3B1D25A1FA810C9F13D5DC956DC3FAB081E2 62C01AF3F60E62A7031C703F3AD0686AC63EC2 C:\Users\SAMTAR~1\AppData\Local\Temp\~DF56D1A A28F.TMP data Size (bytes): Entropy (8bit): D9DC8F98DB6C5132FF5D8C108FF35 17D73A24EAE0C7BA522974E4CE6F335DBD93ECB3 5160B787B3894C AAE649C6E4ACF4E78726C10A46857B3D3840F1CCC 335E3FEF8F3C F6EF16ED68002C3933EF9F20F86A0079CF7B2945D81D06B281D1AEF03DF5931AD77B859 3D4D18BE460B4CC3927D AB26783F17 Copyright Joe Security LLC 2018 Page 12 of 416

13 C:\Users\SAMTAR~1\AppData\Local\Temp\~DF56D1A A28F.TMP C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\001836CEC9B3850D003670B9D75C6973 data Size (bytes): Entropy (8bit): BB4DE8F44194EF5CCA34F A1 020FA8308D6D314F17828DE73D35E0E6755BE9B4 1F8E2A03781CF0ACA358A6C59B6DC1D22110C85DEFB94FBDCB3D44E69BF355C6 E315E2526B05A8590BD5E2E6FB0214E617AFAF377F FC98FE580CBF5E32E3B5FBD414300F286A5000F6FF 837ACD6DF8A57CB9253AEE6D7E BD6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 552 Entropy (8bit): F9B9BD4C69E5F2455D4B81BD73A FE76748F673D5A2FEDBAF22EF6AD6BDD48BD5 3FD38F1B25B866569B2D6609C979A6BC35EE4B69C71578D0E12DF515B7EA91A1 E D9BBD2DFA4820F884F A4F398E9D09E47ED29CC0395B50D9F41401F565092CE9587D56132F01 8E26EF0E1F8D042D3D1CB FC6D94E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_26F9FF5BB38FE4DAEF20A B8190D4B2CA data Size (bytes): 471 Entropy (8bit): C4E675599D53AC2CB426DCBE546BF7 D7FDC570843E267D24F B6B43F47EF A9FDC84BB693301B C5F397174FEB51C202560DD5B2AB58F23B C3C97319E323C8B72D41F5C1815A80E5B8330A98C10C00E71CC496968BB BE98D859150A97B0CC6C57426 E587A358AB89BAE94B150C2596DE6688ABE4B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ F846F08BEFE0DD8112D932FEF data Size (bytes): 543 Entropy (8bit): A44610A723F7DD5EE6D1 10A1C166DDE69ECA158A C6BEF8C9FC8 3ECCCBA C39C7FEDDB758C91688C007D662D06B310DE7A32B03C 3291D47546E3916CB6655E7EB638C49A99FE0602C31C5D13780E448FBC384BE2E799F D3DBBD57D61BFF6 28E7B50005B7F9429C5DF16C00349C680A249 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ DA7B23A0B8C1E6C396DBE1E data Size (bytes): Entropy (8bit): AC AA3F58E8267ACA C Copyright Joe Security LLC 2018 Page 13 of 416

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ DA7B23A0B8C1E6C396DBE1E 95D232C40023CD7585E7B C199663BEB14 A98B A0B3EB8A3D3DB219FEF72EA6D76590A93F95AF32CF7EBE 065C487C BFDFA701889F0C629B9913B5E37A18238C7C16801FAF2AC867D380B6F A9391EAEB48F F5F66B9B7BC7D9C6028A3BC4DF450CD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070C03D13B170C50ED5CDDF6BA1053A6 data Size (bytes): Entropy (8bit): F1BBFDB625CE36922F C2ED7C0 B2695ABDACF6512F2306CE174D4F06DBE17E5B47 1DF5723C DBA224CA9B731D6F870DB9CC0C6579E88C98B205E491D5610 B1630FCDE98AA122F C23384E8C4BFC1B34DB00657CD19306CD3454BAA966547D60242F57CCAF8D2C7D8 8AB48C6F6E9892E15684CB28899AC1C9658CD7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E D9D67350CD2613E78E416 data Size (bytes): 1302 Entropy (8bit): A230BDAB55187A841CFE1AA E4734F757BDEB89868EFE A327695E D73494E3446B B3CDE3AE1C8584AC26E15E45AC3EC D90FB C899CB1D31D3214FD9DC8626A55E40580D3B2224BF34310C2ABD85D0F63E2DEDAEAE57832F048C2F500CB2CBF 83683FCB14139AF3F0B CDB4689C54 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E CFEB33A58 data Size (bytes): 531 Entropy (8bit): DD754F51E28F9AEFF863654C74AE9212 A8B08715BB5DA8DEF28197E31C25F8A33CC83372 CAB66E610B711C265AF248C8DE27B6D01D0DD1C914B255894A2C1B8BD8095DD5 FC0B581D22B8A672D6AA8CF433A A A84643BB9AD2D98B03161E56D7E11A3AC95BAC E 93A1B51519D33E720E353EC F9C04C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C EC2F data Size (bytes): 1521 Entropy (8bit): A500F74958FF72FE57743DD A8ED73ED753CA9D6BFCAA50C6DB5A2D931103C35 C7857D809186B200FA0C5FD5DE3A EC159FF425EC639117B4B1154F 90F845BEC3D FCEA75406C117FC EB820342B7036DE9296AE295115D7D53D05BAB62F E0459E598B28E7DF8DE01F50990CD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 Copyright Joe Security LLC 2018 Page 14 of 416

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 data Size (bytes): 782 Entropy (8bit): A C598D32A188A57122 B5B8B0EC0AD69FBFE881B0C31A3DE09E376B8910 6CEB8172E20099CABE1E7B62B4AA8BD071C2268F283B28272CD3ADA DD D267E5AB148ED4CFDF5D87B18C62DB16142F48D45C2E44F2099FF84F5F45C4023D3D71D0D88B5EDB9E08079B15 D5D2A987625E6E6A0336C16815ED54F6E1F0ED C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_0A997AECFBC6C7AB30A98 E11E80C8E17 data Size (bytes): 471 Entropy (8bit): D84E89BFCDB1D0E842E79A724E310D3 DCD0327C9D1DA A6D54C7FAC1779D6 1AD028E E8EDADFE5B20008FD6C782548DB4D006C7E5E57211BD8DC1B 0FBB16B3F1A7BA57CAFD937D2AA30E138BACFAA778E5D071223A7CE68FB5BA340CF52D8B0CC45DE976F5C4A3 7EBA8C11CF5F7FC4DCBE761EDD369065B639F80B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B177 1 data Size (bytes): 1730 Entropy (8bit): A29AF5E074DF506D30E281 E3D5F43AF681E68C8023BED859A6AB76C94FB1E7 C F34328F8245D33307C221DBD7D21F95F611192A1573BA6D1 D6FA898C8CDE6DCF F07EEBAB434B0B6E92D0C09655D7800FAA8893E30E7C52EE342A38DAFC2B3BB D264E4DBCEEE3831DE61A7EF5CEF9C2FBF0E70E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 325 Entropy (8bit): A0B0F21B12751E013E6CA655114D0F 4C47B782C609C4ADDA4D0298E775ABC544DC8CAC A87CE53FCB40C399E4C2B69CC8B1EB9BE DA6BFD56FC34FD654CC707 24DD6A47E68A7FDA1F6B46D034EBC36FA48BE15B3EA9901E41C970DA87B4392D9063E00E8D917C E2BC B0732FBEC63D7F12FE23B5E4B0346B81B2C91A6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\242D23DDBD947BF510369DC41BEA052E data Size (bytes): Entropy (8bit): AC AA3F58E8267ACA C 95D232C40023CD7585E7B C199663BEB14 A98B A0B3EB8A3D3DB219FEF72EA6D76590A93F95AF32CF7EBE Copyright Joe Security LLC 2018 Page 15 of 416

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\242D23DDBD947BF510369DC41BEA052E 065C487C BFDFA701889F0C629B9913B5E37A18238C7C16801FAF2AC867D380B6F A9391EAEB48F F5F66B9B7BC7D9C6028A3BC4DF450CD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37D958F0157C4E87D39A5E7FAB3AECCC_0E496EF156E4B37329D835BF288927D C data Size (bytes): 1831 Entropy (8bit): F31760B3436FE7CE9FB6EE1078F7B37F 4536B7EF1F F3CADE2CB58216C39668F D261F01DDD5ABACCF2310B5F0719A84C7B596B844BB456F45E92F246A8 91E35BEA5BC8B83441F336E570BA5AD829B394E2CCBB CF5841E1ABC316FDF7F121BC8168AA5919E64B C85CDF300D1B3B816213D12454B7781A704EB31 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D data Size (bytes): 602 Entropy (8bit): FBE16A494876C56CFEFFA4A61ABCE6C ABC534C892F8E5E388DD1CC25ACD33B321788D CBEE5EBEDC6D8F41601BF49E22F97474AE4C860383DF72B8806DAC118E0 DB6A271A95C5FE21146FD23B6A30D71CDAE94C721860E874EC822568CF757D2D2859CC7BD AA6D9E14 829CA39C1F0D278D30F6D786D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0C E44422ED38B data Size (bytes): 471 Entropy (8bit): CAE0AF9F2157F865E B0AD9AB B669E81822A6D9BB112502AD4EB555A0D2F756EA 951F18716FE3CD CB386757E0546CC4F FB08AA455116FCBC 13C16399D7BEF633C4034C288A504E8804A8CABC3F55ACD2DFC5FA5760A CD54F52D2FE912E5575B2691 C6B1F07043C4E7E110BEA68C B0602A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4344B8AF97AF3A423D9EE CDE_6BF99D49F7848CB4DF1BBF4D7AE data Size (bytes): 471 Entropy (8bit): C170C31B4749B008150A8BD165C3530E D5C F8535A12D002E3A711ED786E8B1A6F EAE4BF A874EDF13399DF50F F9FF249FD01EAFE610E958 5F50EF9F5B37AC109F078A54A63C4CE98D8933D8512CE4EE1982F88A338B05AB9454CC112F351E785A0F5416F2D DBBFE3E723A6BEABDD3990FB338C5223AFEAD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C622 0 Copyright Joe Security LLC 2018 Page 16 of 416

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C622 0 data Size (bytes): 727 Entropy (8bit): C C76D2AFB6A023BCC7823F 7CCDB4D5468B5A61A D5C632FD537D9B7B B6AAB7EDAC296530FB9030D29924CDD6E2FEC4AFCF2A9EA961D194476C C D76264CC3BD64DFC8CFE7F04FE880AC1EC85BC341B6A729BFD4FA5038A76F777B052758CADA360C FAAF7AC CC4313C5BD C015 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\537EC5B641ED5E0F8A F35B data Size (bytes): Entropy (8bit): B1853DF0B3C8F1ED7B263AB65C9F D3724A2FB3F28552AC9FA6A2E DF326B C491D70565F27CDD1C04DD467DDFCB2FCA43440BFE58EA11FE8D97A6D02206AC 9A CD989C1F FE8B5BE513DBF576415FF13BBB93A9CA43CECDDD1A9E A8DA5B580DDD B7A0207CF92F D2D1A6ED687A9BED6774 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B 4 data Size (bytes): 471 Entropy (8bit): D608A8C2089B6B6C53AE1BD45112A28E B0ED E2FD E74838DC2BA1A6DB E68E0D05DF E44823FF CA33FD9711EA26780F44CCFAB026 A6838C0013F2AF7DAE82CA EA5B008B29AE5B42E EAFD5FE0FDBEB091875E885CD0F B83 D5E9C60C F3C7DF902DE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EDAA817EEF5159B09F6FCD000_0BD C634D7D3F0AD75BE8EBC5 3 data Size (bytes): 471 Entropy (8bit): CD3AD3F3D31AC5F71E5FFBCA3008E8 409B6B56E921E24BF879B05234FD7A1F46A7E15A 0D9CFA1FE262422AB4849D8852FDE43F7E9D280ADE4E53F66064CCCE0E234A1E 3082CA2F78C06F39C404ECB77BE12E75E36D E1A9A337A86B5B1A170FD499A62BBE831D7C5B1E29B52 5A2A8CDFB E504C1C87088FF188F9E5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EDAA817EEF5159B09F6FCD000_5BBD67B6E699F362F30ED6A87DB1CE9 B data Size (bytes): 471 Entropy (8bit): C950027F35FC2FCF1861B7A96BFA4AF 812EEBD4C58417CA16CBD1BEC9491D783588F973 Copyright Joe Security LLC 2018 Page 17 of 416

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EDAA817EEF5159B09F6FCD000_5BBD67B6E699F362F30ED6A87DB1CE9 B AF24246DE3C6D3E89CCE04EDBEDD0778AFAEB570C2B6CDC61CC1DCA4A375C2EB 4AFF332E7644B61EF7BBE FAD54C54CA817912CFB939E09FDE41508BE1CDE07FD1F9BF6D4F3E9B4F E AB DDDDC2F11D012162E780 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896 data Size (bytes): 439 Entropy (8bit): A76B87E3E2A9F0C864610B7CCBC3C AA0762C939E3155CCC4E051F9B2EF5B1D060299D 2176AE7D47513B54DADD14FF28C141A7BDC92EF6F84D211C B60D8644D D4D41551C97E8E422A9D7D9CEA3953B3A486E83B711DCB11E04CA9613A179272B3A685268F95BF78DB0EFB6B51 2C373A1F B4D2DBA6BC7ABA5DEADA106 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90 data Size (bytes): 462 Entropy (8bit): A68A2AE020719B8942F12700C2AA7326 8B382EF2E4FE11578EB042012F49DA87F2CC56E9 D605EF4CA0057C59A4E90EB65A86BFFCA2A76509F5D67A2B7C6FCB66DA48B95F E9E343A249A7E304703D C17A870C4245A84755B2592A6736A70CD921D0B249A14A7EA4E3C9674CED206B E0D D A722A7495CE672BAE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 531 Entropy (8bit): C182EF91FA1D94E062E30550F D5AD99A3825E217B32350BA0F17DFD78BFB91643 C773F30F77F8BAA03828CE4E66C6622B2F35B2F8E4CBEF ED68AC2407 CC61DA B7AEF3C81A0A0C99B70875CA0F4A ECF42F0FE8368FE AE3F06AF180E19A266 72C0BE34714F163FCB93E12761E6ACD4CE81D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50 data Size (bytes): 434 Entropy (8bit): CA B3A8B8E912E7D2138B DEEC92073BEA F ECF6F2750B1B4 A7692AA2B5B2664DE344B922A091B7BA6F4FA01A4FFC80F279BAC31D4A3E468B F8DC07C60ABEAB1B60DED14C3D51C25A41F28FA7EC657A06038ECB2AFEF D FAFBD A 8ED5A2039A20B37F3A341518BACDD319C7B6D02 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Copyright Joe Security LLC 2018 Page 18 of 416

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 Size (bytes): 471 Entropy (8bit): B93B055F18ED02AC BFA E49C843005A144BE3DE9485B1F9BC4E5A9126D A2649B55B45DF55AC2A B428AD312A749BDA88AA21B6C800DCE6AD4CED 1A7E8C92A1516E9B2E224E239C29EA395C615585A429B5FDF66B794DBBE6336C2BCE435ACD4F145563E5ACB4E DDBE001566E1BB345BF9F6F5EAE0341B9AAB2A6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 471 Entropy (8bit): AEA98A8B257C0958C1B93FEFAC07CB 0F6674CB94E9B0BBC00861E77E3D4EF7364DDE99 B210CEF267DA647C74A99CBE49E261346EBAAA3BC3B4264CBA17CE4B4A5C164C 3DCCCDFD39354EBB23D6CD5BADF195C01F69CF0D53C8749B777DB8DA56E2DAA2A4A60F3BD3E381CFB3BFDB7 AFDBD353FF CCAD392E04E4ABEE8CF4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6FB1C7BC744B04B7C9588E58823D7FBD data Size (bytes): Entropy (8bit): A7FD09B4038B947DB1A677BBE0A 1F445ED1B0BC6C3315B55D606BDD3F44C1790D1E D548B72A7A23672EA0C0200CD9A04F52E6E F271CE06453F024AC511 5E98A9C0A179917FFA168B28B061B95A68739AE301BCCB71B611224D63CBC0F374A072FAF7AC12BB3832E4E20F 0A D226851D0DB429AE119CADDC130A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC _93E4B2BA79A897B3100CCB27F2D3BF4 F data Size (bytes): 1426 Entropy (8bit): CD6B131CB858F F04321B 36CE9DAAF479D EBCCD607094D6DFCE 5ED164EE671C0F9012B49C6C89D8B80F10022E43232BF0A9B9E6CCFEA264F21A 4E72D2B51453BB49E46BB7D86B149DB12B4D18967DEFC02EF69D439B5A6795D615513E9CDD0F324A04096B B6DE986E857BC843A629CA7C2AC6AF7FCFA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Microsoft Cabinet archive data, bytes, 1 file Size (bytes): Entropy (8bit): true 89BDF8CFF3B90356B6E57BD51F6DDEE8 EE5CE85ABD2594DB8050B76462E7AB602D9E169D EA99A003C32F94FBBEDF5965E2A9DA9C1D7FAD954D37E9596CFAE90C4FE725F0 Copyright Joe Security LLC 2018 Page 19 of 416

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F F31DEC84A3819B12E70324B8E239FCEE0D52C3A451E7AA4744E38D9F870C1D01786D5E8F9A355E440C82A1ECCA A199C379C9F15F2745D8A1C68E178CA187FB37 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7810C722F621F1DEEC60D43FBB data Size (bytes): Entropy (8bit): E B1FCF902EAEBB9E009A92F 48F560F5841BD43F7DC19C9850BB0F0EDCF1119B 0B7B9540B718DB F14FA AE5A90C8BB6D3126E2927BBC53AA98B 0A5745F8CB1C3935C79F844D96ABF257A826A144155D9475C7C961DFA0CBEA2728F097360D2570F8211A3EF1068 D863D3733BD3654B307448B5EE91D330640AB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_426B797803FE239319F133BE151A40A1 data Size (bytes): 463 Entropy (8bit): B6F96E956B0CFBE85A52762E5290A722 DAB9F B76C50A6B879E893C52949D48D 0CE5A8D508FEF188146BC91C9EC8269C04E5FE31AC63DACF5FCE22A36C7E52A0 A9F8F5927EA9EC24E5E92DF5D464ACF6746D C378A55C61FA03D054571DD99E357CD1C8B18CE16517E12 B19D8EF3F6C1A F270B2F46A12A257D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_F400ED6670C6C1513DF5EF4A682530A B data Size (bytes): 463 Entropy (8bit): EF67231C0308CAB53B8AAF3FECE1FB53 3B4FCCB51C9361ABB7B7FC55EB064905CE5831F1 8A6596EBE809D31868D4192F63F6BC64AA8F7E997616A464AF285EB37D B5537AB30A426C89609CC3987DE28B0A84C47925C8E1F41EE5AFB66179FCDC410ACB7BCF24AC5048B8F6DB CF5D33C6FD7693D09013A6CAC9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 data Size (bytes): 1391 Entropy (8bit): F8B DC29C31ADC32288BAB41 3B898C2A772558EE28DA701FDE12BB0912D836E9 EF6A5C15E25E69794B79A36843AB2D34E3910AB97ECF64F50C2F7EFB6DE7DD93 1EC5AC99B24FE95A0D8F2B1EF5DC3CA64E3535F7D10AC1BDF3D3C5561C31966A50B17D8DB48F84FC1072D9BFE CC19A3E3B36896F64752CFDABD224C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4221 Copyright Joe Security LLC 2018 Page 20 of 416

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F Entropy (8bit): A4AA4354C48180A889F3056B123C9E44 D6E283E452B FBD9153DB633900D78E8 057B0E1C559BC5B153C01C C4B53D157E45D30272B C D5C8BD58B629981BF7C2034E3A0FF D59810A3B73A709D1BEEF DDBDD5EF33B55232C E FBF5A2F0A10B2488D304FF9F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC D220C7448 data Size (bytes): 596 Entropy (8bit): B9948A A C F EEBDD643047D A 9EBC8C77D2870A85CA440CC18D75B38CCF07B3D4AD662817D285C0FCCCA DF4E4FE9A869FBEBDEE18356B8EB7017D97687C3844E8477CA74DF416B05474F51D99BFEC8FE86ECA81D69219 AE850E3F990F9B1FE56C38B68B C60CF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A FCFF127E4EADADE B data Size (bytes): 531 Entropy (8bit): DD754F51E28F9AEFF863654C74AE9212 A8B08715BB5DA8DEF28197E31C25F8A33CC83372 CAB66E610B711C265AF248C8DE27B6D01D0DD1C914B255894A2C1B8BD8095DD5 FC0B581D22B8A672D6AA8CF433A A A84643BB9AD2D98B03161E56D7E11A3AC95BAC E 93A1B51519D33E720E353EC F9C04C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\96385D66FC0D184E05CF52F82EF524C0_211A310D4F931FB5C44BEAAD745DED1 5 data Size (bytes): 1831 Entropy (8bit): ACB27FAC1B7D1E5BFDED927468F5425 D622D96459C13670BA4CF87161DAE5E4C8DC589C A7B1750A316878BB3F ACAE0FBB2036C2646D3045FC654E768A1C8C542 8DDC50498EEBC6EB7CE56D3EF B9933B01E3C7B04D48AE954F3FA1A9E CC5F73371D939B1A27 1DA8EE436A8657CB034F02C6ADC947DCC79D6E Copyright Joe Security LLC 2018 Page 21 of 416

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9F9C58BCF02CB8A34F017EC53AEBBE1C data Size (bytes): Entropy (8bit): A7FD09B4038B947DB1A677BBE0A 1F445ED1B0BC6C3315B55D606BDD3F44C1790D1E D548B72A7A23672EA0C0200CD9A04F52E6E F271CE06453F024AC511 5E98A9C0A179917FFA168B28B061B95A68739AE301BCCB71B611224D63CBC0F374A072FAF7AC12BB3832E4E20F 0A D226851D0DB429AE119CADDC130A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A3D5BF1283C2E63D8C8A8C72F0051F5A data Size (bytes): 712 Entropy (8bit): D94F1E22F1BD768583C33CA604B04C7F EA77754E95A8A083F2624E68D87D6BD747A0A138 23F85655DD756A38954FD63F2218B4F6FA6BBFFB5467BA02F3143DC7E4CD36C2 12FB2B5E831F474BCF2153EE7EEC2C727B2570E ECEE0DC4C03B693B03F1A79BE4E E638F4 E4DCA79C364E BAF5CA94258BA246BC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F DB21AB308D_592839A8569F831D0F2306AE4BB5C24B data Size (bytes): 471 Entropy (8bit): E8FE21AECD167FE40B595ED860E2E0C 7B310B2E0A806F3381E04A0CDD0945FB0B432A7A BC7E56C608F42C648A36F0DF872AB93DCBCFC052E FBFF519579E61D EFC4744D946E4817C19D1C931D3C0A24EE20900B9AA23735CE7F5BB36A52BD09C221099C09B38FC B F EF84C9E5971B B46A3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A6 2 data Size (bytes): 1744 Entropy (8bit): CDD25B D7F01AF1028F A7CBF59EB46D49E18134E07B98225EA67B08BF04 AEA1027F9176EB47EFFD615A50BE04B43C4FEEBB832D36A7A0E2A10F397DBD41 E7589A834BC06D9F8CC50926DD1B1B4223B883D A965B18ADA3E5125BAB0FE45B EDB94A4815E 11A8D E4CE37B015E06DE3B78836DD94 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD data Size (bytes): 1548 Entropy (8bit): DD4A4D856D8CEA72F747B557B31F37 F934D9CC64E7AF7FD516B516726D3A226EB15AB8 7FE050C4CC8E4BF83573D3D78D367F E7FF709C6B3F6937F51B20 Copyright Joe Security LLC 2018 Page 22 of 416

23 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD FC0AFD468F62E5F42F5DDE253C939018BC7E1C974893E E2C569F15F3FBCDC D350EC152D9D0A A7F5BD11FBAC15A50E991AB2987A608A39C630 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F data Size (bytes): 608 Entropy (8bit): BA4BAFED05B83120D4319B565AA08 14A D60E10A0B834EE6C9B9F762F83D FCE2ED7B48D566A1BCD6EFBA6A4AC8C1BA9892B7CFC95AE4BDEA7534A323C6A6 3D9C347BC2687A66F004D4F87773A5F0B3CBBE6505E015AB253B D0CD92E5FE8F37DD735A761203DF3A CACC8C326C57E43FCC7E768AAD3BAFFEEE11A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1F52EFD459704E23E98B5C774A45162 data Size (bytes): Entropy (8bit): F1BBFDB625CE36922F C2ED7C0 B2695ABDACF6512F2306CE174D4F06DBE17E5B47 1DF5723C DBA224CA9B731D6F870DB9CC0C6579E88C98B205E491D5610 B1630FCDE98AA122F C23384E8C4BFC1B34DB00657CD19306CD3454BAA966547D60242F57CCAF8D2C7D8 8AB48C6F6E9892E15684CB28899AC1C9658CD7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5FD5BF0CE6372B1CAFE381FD0BC969C data Size (bytes): 429 Entropy (8bit): EC298C64E5AACBC4DBD62633AA53A80B 5A5CA27645EBCE6B9AEAFC9A803C39FD3E2C8B5E CC4BEAAB8386E2700C8CED0C4556B2C24DBA47B6FE9F0BD4D9AB2B408C9355A9 874F02B0FCB2A7A00C79A E92B8E45A8BC6FF34B90E079578F3E4C A26659B737B2BB10CB662 9CF95F06BAC0F6D4240FCEA2675DB472AABF1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D data Size (bytes): 812 Entropy (8bit): DA1CF577CFE32A1B1ED7D21A6038BD7D 6F8511D0E73166A3F51FE8CD24646C64FA5C BC42F E94903E1B5A22C97281A9432D81FEB23174AA564E84489BE94 7FA33C42235E53A43C78851FADBD85AA9CA9441DD30B7DD04FF53125EC E3D CEAB2011DA8C 051C4143EB7AF8DFEBC417D0FF5D9B5E3259E8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CCFB45DC01E4F1B903156D3DCF37211F data Size (bytes): Copyright Joe Security LLC 2018 Page 23 of 416

24 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CCFB45DC01E4F1B903156D3DCF37211F Entropy (8bit): ACC86631F070BB434C100EF229B39624 D059ACDB578EE63E75D6A31A6E6967A16412F CAD94DCF1A6B0335C0BA083948D53F54D5848D3E1B491AF47DEFC6530D6F D6DA45EBB85DFD02B84CA CD98947C548CD25A45B68BF92642E566BC5F4C506A336F2B611560B 2B29ABCBFE5EC994A166929B546DE93B0D7A5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7B4E43171BB9E412497B0377F4343E7 data Size (bytes): 665 Entropy (8bit): C0FC7EC6D88ECC67E0923EE47D40E10B CD441B B732BB92E3B22F62F4 B4B70625D79853B396A7344C8481CCB068A115DC9B442303C40B26999A86DD6E 63C93C1B2E363824BABDD F973EC3FEF8E3CE0347E7F55D E2B351CB401B016CBA962D2B B8F79AA7E7693A28ECCF0A695C1C2A9FFB3670 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DC6B80144D0FCD1DEE F8E1_8CD9E2FBA1704DD67C188 AEE51D99097 data Size (bytes): 1776 Entropy (8bit): EBFCE2D3BFD868AD81B13C4B8016E5B 7677E32CBDB86F8FE2DCFA65A9C55B4E6D884F4E BABDD097FE780EE6E1D12128CB C134F181E5641E14233EEE1BBC4B305 B017F BD64D4BC4540A9B488E561545DFEEFC0DDCC205077A0D0FC5CC11A68360FF818A2A2E428EA315C 3D12FA2210B3B17975D17B46B9F03676FDB411 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_C48486D082C63F16CB1D0 680CCDB69F7 data Size (bytes): 471 Entropy (8bit): D16E469BB D F3E2C50 67B1F00709C713E4B6A8E69458F A 43D91EEF15185BA78DDDB1CEE28E927DB929C87F5448D4E1500FEC8E76712F2A 4E31378FB65259DE29423B0E3BBDC3E63CB6A18B00C8E8CDF5CE673ACE0D8AA8B8E6E7B A423C5EDA E8E37CFBD1B56FFCED8F3F9446F0F CF58 Copyright Joe Security LLC 2018 Page 24 of 416

25 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_C48486D082C63F16CB1D0 680CCDB69F7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E665346F0BE57F34168E0A55B data Size (bytes): Entropy (8bit): E B1FCF902EAEBB9E009A92F 48F560F5841BD43F7DC19C9850BB0F0EDCF1119B 0B7B9540B718DB F14FA AE5A90C8BB6D3126E2927BBC53AA98B 0A5745F8CB1C3935C79F844D96ABF257A826A144155D9475C7C961DFA0CBEA2728F097360D2570F8211A3EF1068 D863D3733BD3654B307448B5EE91D330640AB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E961199C820C769E8780DF5E0A data Size (bytes): Entropy (8bit): F89C60B87CA5F079D256FC5EA5A968E1 E0222AF567F5B9C1F2F73D1B4E59F79C00729D8B DCEC8AE7A87B66FF329443F6A7DEF6A9CF CCB F3 623DB1E8C800B4E962339CBE302766EA65DD03320C25A43D5D99A67AF3E958FB5BFEC6CF3FD156FEE FCA6C74B993E2733E779B0B30D1F6FFDD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A A396_D76DB901EE986B889F30D8CC06229E2 D data Size (bytes): 1697 Entropy (8bit): C0BC745914E9B0A18E23529C74C903 8F632EF4175DF5ECFB700170C237EC17A7E0F097 9E23A051AF1AA5E8B2BB615D4ABEE44C85F90C8937BB286D03D6DC4839F46F07 E6FC83E685BB2308DC31E58C7DFDDAE4C3DB711EAB5557B042551BDE07B5CF3A622B4B60C EE4E94AA 2FECBCC9139EAEA9E00D54CDCEF00BA8C7D686CD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E B_C31B E340573F1336DE607D619 data Size (bytes): 471 Entropy (8bit): FC50C762E04E4AA7CEE35FD6810A 8E056A1B45F650E94007AFB25F FFAB0A3 3BBC48A2F4E6D884BB192481B1FAE59891F9D02B32165D05D878C3C8C2BD1B2A 4BF922B4D97DD2D9309D D45537F0EAD0348E541C60BCBED73E82283D83785BF4BDA569E2CF3C1C93 A8D6B471E11BAC0C4BE67D99FAC9FEC2028C17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F B15AB61E0E47645E5 data Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 25 of 416

26 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F B15AB61E0E47645E5 9FD8F181715BB7B47964D383E70B5B54 5F3EB7C E5F0B6407ED4E34D19218AF9BB 9D79E2D96BCDE9C376FE3FF395B163DCFBDEC01ECC17B880E1212A099232A58D 0BCED0EAC27743BBB999C612940FFA7C2F1E5E250700D5362ED33B6A244CA2C19C AA FF58445D 55E2C68F1B A2A836244E0E8C269 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_AB501A3D945868CB53EB6D4176A33CF A data Size (bytes): 463 Entropy (8bit): D6958F27B8C221DA502F35912BE3E1D 538B DF4C171CC8836DB0D7F5AC662F 5209E9F9E58921E94E2050D42696A3CA890946E02A1D0FA9583E43A55D3E4438 4F86125FEE7C645E00FF31B5F9A021B199BCC246F5509C8BFF A9D78DA7FC5BFE9F6553EB CA EB801E346F87F532C4E3017 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F94FD5F2AAEFDB A4E9 data Size (bytes): Entropy (8bit): F89C60B87CA5F079D256FC5EA5A968E1 E0222AF567F5B9C1F2F73D1B4E59F79C00729D8B DCEC8AE7A87B66FF329443F6A7DEF6A9CF CCB F3 623DB1E8C800B4E962339CBE302766EA65DD03320C25A43D5D99A67AF3E958FB5BFEC6CF3FD156FEE FCA6C74B993E2733E779B0B30D1F6FFDD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE0DA2326A F66779D450C7D6_78FB178A52778BDEDC9C9955DD948B91 data Size (bytes): 471 Entropy (8bit): F2C05D95111C6C0EC CC3AB A7CAE929DDE894951D380DB85 3B7CC166F5033F5BA939EA0C4F3D6A148156F5026FDD9A44FB0A7FA70366D5CC AE42665AF0F3BDB6C71E78CEE9E0D8CD921D1CF896A1834F3823B4C6F23FD70EAF7FCFD2C4600B32C3FDC1CD 4517DCFB371A2996D4BA0D774FAB43DD9D6E8D49 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\001836CEC9B3850D003670B9D75C6973 data Size (bytes): 264 Entropy (8bit): B3A41B262BDDA7423D33E1B469D6DDF CA9D12FF6A6C8AF32FA6D6B9F59888FE6D97FE53 3A3B255B1757EAD8CF5D9FE8329CADF15D F1FDFE0439FEFAFAE41 97B0BD802C7A13C026D06CAAA1FFB053A9AE868526E8BCA986DECCED5D40B B28906B31F087881B 73BC0B53FD407BD0F8F24C974C40D390773AE3 Copyright Joe Security LLC 2018 Page 26 of 416

27 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Entropy (8bit): D4EAD32DC8D916D28F48BBF9A2C8 FDFDE499EDE4BA198174D578D62F8625A67F3C9A DCE355540FC57D57853B2DD38BE088EEAA11FEA8B6F5456A205B8C8A1F0E549C 503C0DFFF94C7E3979E ACC87589C78D01FE7B B36CB369A3DEAB42D6AB0BB247DAA047AE4 B000EEC3D22C45D3E18E6F28163D9EAD410C41 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_26F9FF5BB38FE4DAEF20 AB8190D4B2CA data Size (bytes): 404 Entropy (8bit): CF42EA6BA1F517C0E79D2FFB6BAC0B F779B0775D1AF6AA0027B363DEE27B2D C A8658B80BA36838B6D6E4C0D5630DDA0295E CF C08A7F086AF96BB9B577B15F59FDD7F81283D85B47570CA6B294FB1552C14B43EFAE71B829898B87EA914804C98 F744E9746F748D68434B AB043A654 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ F846F08BEFE0DD8112D932FEF data Size (bytes): 468 Entropy (8bit): F9FEC72031D4D ED6B71F6D E7984F1389E5487C C72AB7C81E73933B2 093C2DA2B3695DA9FF46FE0AC13ED105EA6C87E234CDFADA65EF099D38A6B7F8 3013A85C6CE1F22DD43D52603F06A46066FFB19AC6FAC6EBB0B3CF65C579E8D555DDC83F191777D6C A6 24FB38B2B720B9977BD15AB F10DC9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ DA7B23A0B8C1E6C396DBE1E data Size (bytes): 264 Entropy (8bit): C88A25C3AAB8B92E1BD00269DD5DDC 8CF48C816F65A79BB227640CA9DE14CAD9A49A82 9C1BC233D3A41DD7612BEEE5DD6CD780B043F917757B43ECD75A8E55D0B2BA AF1C C934A8CF2E40BC826FF2C47810B31B73CDE4F293923B6D384C7D2848CA44EA693BE6EC9C D0F1882A8FAC0F4C94F6657B3CF204ACEAC6FA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070C03D13B170C50ED5CDDF6BA1053A6 data Size (bytes): 264 Entropy (8bit): EDB79006AE685EEE102172FB98 E3FC7C8E3C6E215D9AF66656F4D439BCBF79D0DB BD686C304AF2E8A43A7EA2E9EC3B413A3A0CE790CACD68A9A213FA87 Copyright Joe Security LLC 2018 Page 27 of 416

28 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070C03D13B170C50ED5CDDF6BA1053A6 9822E8BC1E7648B323A638F1115A61EF0EEFB0ADD7DC5A7E1D35C764E48E2323CBFB42381EC55B3B491F40C388 22F8D0E509BC327332ABBDA17E513078A9CA5D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E D9D67350CD2613E78E416 data Size (bytes): 230 Entropy (8bit): EB32FC1A8D85BBDDE7F0F753CB2AE28 8EE8CAB09AD61607A3D2BB96D A0AE03 3B5C6D64659C501AD00FF8B496C8F8778B AEB6B21FCF9AAD8CF6D F4505F4C95685C3BF207AF8F2EC81B81F7EC12036BA BD6FCB4682BE65BE08D62A40A02225F9FC8CE1029 FABD2F0C7D05041DADABC9C49CD86DD971A6B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0AB67BD4882FB0E CFEB33A58 data Size (bytes): 216 Entropy (8bit): E13DE9B6C7D153BA3066A5C E6 0ABF E C8CF8F53D19EB30C5DEF FC5C2B646C8CA2FF845FCCCBBFC FE47EFA1AB06C7B533D2D75E8B2A CE8390F55D34BCE560BA17E8947AEF07E9B2D87C52B70EDB25EC2EE378B951071E880197BFA60B566D07DD EFD5F0FAEEDAFC62644C388F3B5D2A4AEEC8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C EC2F data Size (bytes): 1000 Entropy (8bit): B389A6D9AE66AE4BA3FA855B DCF C DD9B598B3AF27BFF8D88 59C85F0BDE6DEF5F4331B9D46DC96A8559F604A04AF5E8D181F59E285D7C692C C83074D8C93370D3583C E AD829CCF B6A2D5D4E30D592C3AB9949E8CEA5E 33D3295DFFA DE130FCF231CD2C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 data Size (bytes): 186 Entropy (8bit): B C115BE5520E455A 8AB38352DC37A4FCEAE2C84CCCD3F26CC8656EA3 83DC6F610B17E4E3E1DD3C02F188F955FC845E7E6ACF A4F6A F84D0F35F94F3E270B02E B10A6EC9B0C5EF5E93D6B8A58E66958BEB1A9D9C05D8D7F940B7A0E D7D6DC0DDC FF86F366E450071F7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_0A997AECFBC6C7AB30A9 8E11E80C8E17 data Size (bytes): 400 Copyright Joe Security LLC 2018 Page 28 of 416

29 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_0A997AECFBC6C7AB30A9 8E11E80C8E17 Entropy (8bit): B8AE49E0F316ADC9509A9F302D6CC03 916D2D1AAD799A97DC2CF8CC56E1C079462F C A28727A9570F835E545E5B491269A399CF9785AA796AFD424 2F8C9AF8A0FB6DA4AF0824AEFF4B4FDAD9E9D98AE1D066B D7A4E1A153270E6F2EDED9B A32 39D7113CCC035E104FCC08C1BF E7E43E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F26 1FA85A0B1771 data Size (bytes): 450 Entropy (8bit): FC20CD18EB1EC7296A40A873E1B35C6 CD1104BA572B2EB7023A38FE835DCAA0069A7585 AD36792C2DEEB3C673313BBB CE4107BA808ABD7A2802E F 00C620DC A96350AC3A3769FC84AD89B2273C590B407C DA20B6E1FE5DD8535E554557CC D2F6A5E80CBFD2EE113C11DDB461AF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 584 Entropy (8bit): DDFFCC6DCD38FCC24BD787DA133CCCA B4E9D278DB2D88A7EB8E9906CEB5F592D45EDB3B FBCE235B0EFC638F DBB0FCEE2FF9F3B5FA70B592EA535BC19240D1F9 9B8021BF3A83FF09899EF99F80FA7322D82AB6F7C1507E093FB25E5082F3A41EA742AF1B9BDE5BA943F496DB95 CC733EBC A9E5BFE01543B5845B18334 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\242D23DDBD947BF510369DC41BEA052E data Size (bytes): 268 Entropy (8bit): D6957F81DDAD5F6B0CEAFCF6FE8F48C C4A126DA116CC11EB7ACA3CE33D9C DE 3D2B10E3B517D10E686F53D8DB971ACACCF3D70A8C4F85A5CAEE445E394287D8 27FD4BBF9B9EDAB3A744926EC3FBC4E87C B19DB4832DB18684DB0F0A840D71CFA0A2D7C360281AEEC A8ADC B4E93DE677C6F05A99AF03A15798 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37D958F0157C4E87D39A5E7FAB3AECCC_0E496EF156E4B37329D835BF DC data Size (bytes): 498 Entropy (8bit): BB98017DA64382E9CE1DD9EEEBC9242 DAEDF6C3BF B5A840742D5B9A3AD0D 11C7EC129464E6B09CCE9E323D AA9A2A E738C2C16C10C5BB6 14BF CEC467FA6EE95AF880C450B4AFCE262540A3AD1DEBC5DBF99AE19AFF8342C233443A78B8C5405 CBB9D1E25EC77B4120E20FCC1043E6C1458DA3D Copyright Joe Security LLC 2018 Page 29 of 416