ID: Sample Name: message_zdm.html Cookbook: default.jbs Time: 17:40:56 Date: 04/05/2018 Version:

Transcription

1 ID: Sample Name: message_zdm.html Cookbook: default.jbs Time: 17:40:56 Date: 04/05/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Network Distribution TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Copyright Joe Security LLC 2018 Page 2 of 500

3 Statistics Behavior System Behavior Analysis iexplore.exe PID: 3744 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3800 Parent PID: 3744 General File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 500

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 17:40:56 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 5m 53s light message_zdm.html default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout SUS sus21.winhtml@3/299@101/53 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Browsing link: hooting.ftl Real link is: page=troubleshooting&locale=en_us Browsing link: Real link is: Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3800 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Copyright Joe Security LLC 2018 Page 4 of 500

5 Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold true Classification Copyright Joe Security LLC 2018 Page 5 of 500

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample is no longer working Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Networking System Summary Copyright Joe Security LLC 2018 Page 6 of 500

7 Click to jump to signature section Networking: Domain name seen in connection with other malware Connects to many different domains IP address seen in connection with other malware Social media urls found in memory data Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Tries to download non-existing http data (HTTP/ Found) Urls found in memory or binary data Uses HTTPS System Summary: Classification label Creates files inside the user directory Creates temporary files Reads ini files Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 500

8 Behavior Graph ID: Sample: message_zdm.html Startdate: 04/05/2018 Architecture: WINDOWS Score: 21 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend Domain name seen in connection with other malware iexplore.exe started Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious x.ss2.us 56 other IPs or domains started iexplore.exe , 49206, 49207, 80 WEBSENSE-WebsenseIncUS United States static.ads-twitter.com , 443, 49321, TWITTER-TwitterIncUS United States 51 other IPs or domains Simulations Behavior and APIs Time Type Description 17:41:26 API Interceptor 5752x Sleep call for process: iexplore.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link idsync.rlcdn.com 0% virustotal Browse crl.rootca1.amazontrust.com 0% virustotal Browse ml314.com 0% virustotal Browse Copyright Joe Security LLC 2018 Page 8 of 500

9 Detection Scanner Label Link munchkin.marketo.net 0% virustotal Browse pixel.mathtag.com 0% virustotal Browse 0% virustotal Browse s.adroll.com 0% virustotal Browse tags.bluekai.com 0% virustotal Browse 0% virustotal Browse static.ads-twitter.com 0% virustotal Browse secure.adnxs.com 0% virustotal Browse crl.godaddy.com 0% virustotal Browse 018-nkf-008.mktoresp.com 0% virustotal Browse app-abm.marketo.com 0% virustotal Browse websenseinc.demdex.net 0% virustotal Browse crl.pki.goog 0% virustotal Browse crl.sca1b.amazontrust.com 0% virustotal Browse x.ss2.us 0% virustotal Browse ocsp.rootg2.amazontrust.com 0% virustotal Browse ocsp.sca1b.amazontrust.com 1% virustotal Browse ocsp.int-x3.letsencrypt.org 0% virustotal Browse s.ml-attr.com 0% virustotal Browse fls.doubleclick.net 0% virustotal Browse ps.eyeota.net 0% virustotal Browse blogs.forcepoint.com 0% virustotal Browse platform.twitter.com 0% virustotal Browse voltage-pp-0000.secur control.com 0% virustotal Browse 0% virustotal Browse sjs.bizographics.com 0% virustotal Browse 0% virustotal Browse tags.tiqcdn.com 0% virustotal Browse connect.facebook.net 0% virustotal Browse d.adroll.com 0% virustotal Browse static.hotjar.com 0% virustotal Browse sync.crwdcntrl.net 0% virustotal Browse o.ss2.us 0% virustotal Browse crl.rootg2.amazontrust.com 0% virustotal Browse 0% virustotal Browse ocsp.rootca1.amazontrust.com 0% virustotal Browse attr.ml-api.io 0% virustotal Browse tracker.marinsm.com 0% virustotal Browse s.getsmartcontent.com 0% virustotal Browse googleads.g.doubleclick.net 0% virustotal Browse 0% virustotal Browse s.ss2.us 0% virustotal Browse analyticsssl.forcepoint.com 0% virustotal Browse js.driftt.com 0% virustotal Browse fast.fonts.net 0% virustotal Browse in.ml314.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps Copyright Joe Security LLC 2018 Page 9 of 500

10 No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs Match freeformatter-decode d.pdf Associated Sample Name / URL SHA 256 Detection Link Context imecast.com/s/v68aco 7mzSp8JJzBtErub freeformatter-decode d.pdf imecast.com/s/v68aco 7mzSp8JJzBtErub5 bca487ce901890c2ec29438e0db 7da0de2ea3eca8674a0c96f dee16e bca487ce901890c2ec29438e0db 7da0de2ea3eca8674a0c96f dee16e malicious Browse cm.everesttech.net/c m/dd?d_uui d= malicious Browse cm.everesttech.net/c m/dd?d_uui d= malicious Browse t.co/i/adsct?p_id=tw itter&p_user_id=0&tx n_id=nya03 &events=%5 B%5B%22pag eview%22%2 Cnull%5D%5 D&tw_sale_ amount=0&t w_order_qu antity=0&tw_iframe_s tatus=1&tw _document_ referrer=h ttp%3a%2f% 2Fwww.worl dbank.org% 2Fen%2Fnew s%2ffeatur e%2f2013%2 F04%2F17%2 Fending_ex treme_pove rty_and_pr omoting_sh ared_prosperity malicious Browse t.co/i/adsct?p_id=tw itter&p_user_id=0&tx n_id=nxld4 &events=%5 B%5B%22pag eview%22%2 Cnull%5D%5 D&tw_sale_ amount=0&t w_order_qu antity=0&tw_iframe_s tatus=0 ow.ly/u8cg30gnek9 malicious Browse t.co/i/adsct?p_id=tw itter&p_user_id=0&tx n_id=nuhf9 &events=%5 B%5B%22pag eview%22%2 Cnull%5D%5 D&tw_sale_ amount=0&t w_order_qu antity=0&tw_iframe_s tatus=0 Copyright Joe Security LLC 2018 Page 10 of 500

11 Match n.com malicious Browse deloton.com malicious Browse owbe4.com/a/1022/cli ck/583/ /044ac 0b3da603dc ea4b8f92228baf 8fbe8/c87bbaf38d4b29 945b7da12c092baef683 24febe ACHIEVE-1 CONTRACT.pdf Associated Sample Name / URL SHA 256 Detection Link Context r.com/ malicious Browse 24bea02fcf153e6c4ff26fd45fb25 malicious Browse connect.facebook.net 6f6f807a27458b4ba3a5bd22675d /en_us/fbds.js 972c68f malicious Browse connect.facebook.net /fr_fr/all.js Domains Match Associated Sample Name / URL SHA 256 Detection Link Context s.adroll.com ocean.cryptoloot.pro malicious Browse crl.rootca1.amazontrust.com rc=system- -outl ookplugin-new&utm_me dium=system- &ut m_source=outlookplug in-new malicious Browse ocean.cryptoloot.pro malicious Browse eerbuilder.com/share /setpassword? =m scott%40peoplescout. com&token=prp6yykcba 0sl4zhcxhim6xfkmieuj d1jz2taoy8nkzmve malicious Browse ow.ly/u8cg30gnek9 malicious Browse owbe4.com/a/1022/cli ck/583/ /b0b95 ee283cb9cc9fc41475b7 77a158c4a77b943/c87b baf38d4b29945b7da12c 092baef68324febe owbe4.com/a/1022/cli ck/583/ /044ac 0b3da603dc543019ea4b 8f92228baf8fbe8/c87b baf38d4b29945b7da12c 092baef68324febe benefits&m =ABACkYvod RhNiM5Iddc l8b7p&em=n icole%2esmith%40tasc online%2ecom /test.htm com/rtop_setup.exe com.br/fgaspari_anti go/ _mkt/parcela s_vencidas/g ustavoh enrique/about-fr.php? science=s28na6a1wd3 brary.com/relay/?rel aystate= bizlibrary.com/learn ing/?playlist/shared Playlists/1d21d6c b-a660-2deb55 685e9e malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse Copyright Joe Security LLC 2018 Page 11 of 500

12 Match pixel.mathtag.com Associated Sample Name / URL SHA 256 Detection Link Context detail commande.html org.es/index.html imecast.com/s/v68aco 7mzSp8JJzBtErub5 m/tt/7982e396a30be48 7d52872fd121ee /6f9d2976f69cdf 1ec152cfcc7d66e036/e 6b d27ffd99d51 6fd374e0795/app.smar tsheet.com/b/home?tg =explore&utm_source= marketo&ut m_medium=e mail&utm_campaign=ne wsletter&mem=button& mkt_tok=eyjpijoitlro ak9eqmhorf UyTW1JdyIsInQiOiJPS1 hcl0dndsts ZjZwd2NFVD JQOXN6TFhC RXYwdHRYMV NpcEJxcjg4 N2E5VGdRa0 Q4RGhoeTVt R0w5a2FBcW 5cL2xWd1Bj cxhxqlqzuf IyeHQreFdq dhltrgjkddczuytic0c5 bgxrbgdnkzcyythjr3lo Nm5nTWZBUl VPTTlBcXR4In0%3D qs=81c82a99b40eb 1e841048d373fa e9a94aec2f6644ed7661 8dd950c7fc0bf839cdaf 32442b7c4d365047e5c ef315a255e5d41 ostads4cash net/souplink.png l.ru/question/ Southgate, MI Apartm ents for Rent - real tor.com#uae.html er.broadridge.com/ e.aws/win/releases/c hime exe Zipongo Value for In vestment_ Theresa & Year 1 ROI vs. treat ment costs.pdf ostads4cash Po for parts.html b258236c72b256518f09770e61f8 malicious Browse f4172ad528d5508ab5ae25d1 c761c83f7 malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse a25e8dc9589be0cf3b b malicious Browse e56deff3ef47211b95ce684f4d22 8fdec076 malicious Browse malicious Browse f3688d10ae89a200736df1adfbd malicious Browse d690cef9cb79a5eb3060f a28a3c5 malicious Browse c3bfa7f99005d631deb6e5b malicious Browse c bc981aaefa08c2fca5 e18fb30f malicious Browse DOC p df.exe rc=system- -outl ookplugin-new&utm_me dium=system- &ut m_source=outlookplug in-new 791db af19f0f190538b5 malicious Browse dd51abb75dc73e495b5bae f004edf malicious Browse Copyright Joe Security LLC 2018 Page 12 of 500

13 Match Zipongo Value for In vestment_ Theresa & Year 1 ROI vs. treat ment costs.pdf discount_50_ pdf 7f3688d10ae89a200736df1adfbd malicious Browse d690cef9cb79a5eb3060f a28a3c5 a427a959dff52b2edae3ee2f99fc4 malicious Browse bb78548c a4c6ac8 fd3cc9ec malicious Browse malicious Browse munchkin.marketo.net ocean.cryptoloot.pro malicious Browse idsync.rlcdn.com Associated Sample Name / URL SHA 256 Detection Link Context m/tt/7982e396a30be48 7d52872fd121ee /6f9d2976f69cdf 1ec152cfcc7d66e036/e 6b d27ffd99d51 6fd374e0795/app.smar tsheet.com/b/home?tg =explore&utm_source= marketo&ut m_medium=e mail&utm_campaign=ne wsletter&mem=button& mkt_tok=eyjpijoitlro ak9eqmhorf UyTW1JdyIsInQiOiJPS1 hcl0dndsts ZjZwd2NFVD JQOXN6TFhC RXYwdHRYMV NpcEJxcjg4 N2E5VGdRa0 Q4RGhoeTVt R0w5a2FBcW 5cL2xWd1Bj cxhxqlqzuf IyeHQreFdq dhltrgjkddczuytic0c5 bgxrbgdnkzcyythjr3lo Nm5nTWZBUl VPTTlBcXR4In0%3D rc=system- -outl ookplugin-new&utm_me dium=system- &ut m_source=outlookplug in-new malicious Browse malicious Browse ocean.cryptoloot.pro malicious Browse ow.ly/u8cg30gnek9 malicious Browse i111.tripod.com/ 45DOC p df.exe malicious Browse db af19f0f190538b5 malicious Browse dd51abb75dc73e495b5bae f004edf malicious Browse imecast.com/s/v68aco 7mzSp8JJzBtErub5 rc=system- -outl ookplugin-new&utm_me dium=system- &ut m_source=outlookplug in-new eerbuilder.com/share /setpassword? =m scott%40peoplescout. com&token=prp6yykcba 0sl4zhcxhim6xfkmieuj d1jz2taoy8nkzmve Southgate, MI Apartm ents for Rent - real tor.com#uae.html malicious Browse malicious Browse malicious Browse a25e8dc9589be0cf3b b malicious Browse e56deff3ef47211b95ce684f4d22 8fdec076 ow.ly/u8cg30gnek9 malicious Browse malicious Browse malicious Browse tysixtee/ malicious Browse Copyright Joe Security LLC 2018 Page 13 of 500

14 Match ml314.com Associated Sample Name / URL SHA 256 Detection Link Context malicious Browse /test.htm e.fedex.com/?qs=affd fe0585e497fced508cd8 f296887c27f77fe33c6a 1a927dbac9a246938b3f 85d13bbf568d489b9659 0ca1aef c3fe e413ce1d45369 f329 malicious Browse malicious Browse malicious Browse Med.pdf b4080ca1bc9f90b53d123 malicious Browse a7fc c40b086ac1 5e1d998a8d ASN Match Associated Sample Name / URL SHA 256 Detection Link Context AMAZON-02-AmazoncomIncUS 53Payment.exe 753baf9f3312ab82986b62a35395 malicious Browse b8c0ac03ba6476bcf6a9f571a 21a41892 ao87si5uju.apk jones@ricohforensics.com 13orders exe 6341be988be00042c698511fd88 malicious Browse c97c618e6109afac40fdf5bed523 83bcdf18e malicious Browse b5aac54456a037d240f malicious Browse e9962db f4cb7fa3f6b09d ed258345f wccftech.com malicious Browse malicious Browse keyserimpactseries.com malicious Browse com.affinity.red_sox _ apk DashlaneInst.exe 69894f963d a4e4 malicious Browse c16c2e6c838db482abc1 0bb7a3453a 0cbf83f1b879561d0041a0fef26d5 malicious Browse c570a b9ca7ecd9e5ae 4d9474c4 empireofdeceit.com malicious Browse PO# exe ics.be/kjsdch Proforma Invoice_d ocs.exe 66Bank Receipt.exe ddobeflpla yerbrsetembro F exe m/affiliate/referral.asp? site=rea&url=po p/en/ukc/1&aff_id=58 43_27027_1 9234_535127_1_357_ /educational/famzoo/ YXOpwUgugb.exe YxgDiqRWX.exe i111.tripod.com/ c6ec8728f7e909af51fa9a364a2f9 malicious Browse f61b5ec613dc37b18c95df2177f3 da9910b malicious Browse e765b41b0aa21f4e2313bd22 malicious Browse e9efb167b5ac8c2955f355f526aa ef6baaec1 8755e9c426db1f40ff1a68f100cb0 malicious Browse f33eb65a99b aad810bc4 0a5f9cb6 malicious Browse malicious Browse malicious Browse b61ce3d5d75fe4a cdfa malicious Browse c47ba6543fc568ab3293ed339 83ff717d8 60c5156e56e93c8ba14bee4af94 malicious Browse f2963be8c8d7bf469a892a1751d efd malicious Browse OMNITURE-AdobeSystemsIncUS wccftech.com malicious Browse Copyright Joe Security LLC 2018 Page 14 of 500

15 Match Associated Sample Name / URL SHA 256 Detection Link Context m/affiliate/referral.asp? site=rea&url=po p/en/ukc/1&aff_id=58 43_27027_1 9234_535127_1_357_ LoginMembership3651. pdf ommunication.com/t/v f4b36ca70 b0a6e965fd798/e49e e ef3 a0bcc6/e49e e93-87b0-c9830e14f 2eb detail commande.html flashplayer27_xa_ins tall.exe freeformatter-decode d.pdf Manage Information.pdf imecast.com/s/v68aco 7mzSp8JJzBtErub5 arationlist.com/orei dunu/alaanu/index.php New PO #G411.html lk.com/slotcartalk malicious Browse a3215cb1fb71deb4c35cf5677f9a malicious Browse ecfaf880c5ed4bec90e62aa53e2e 8390fe38 malicious Browse b258236c72b256518f09770e61f8 malicious Browse f4172ad528d5508ab5ae25d1 c761c83f7 c3ad1dd42801ada280e42eb3e4f malicious Browse d00fd402f3b0213fee4c467fb2a8 f1ded88c bca487ce901890c2ec29438e0db malicious Browse da0de2ea3eca8674a0c96f dee16e c5e4cfb02d9029bd8f20c70ca6c8 malicious Browse e4336a2521ae5e6791ba6fd3a 0eb5df565 malicious Browse malicious Browse e2f295f6ed5c8c14db9b2c816e56 malicious Browse e21ec827a053e f3 a456d1dda malicious Browse malicious Browse t.com/default.aspx?a bbrev=tasc&l=j&issue ID=2OJk eerbuilder.com/share /setpassword? =m scott%40peoplescout. com&token=prp6yykcba 0sl4zhcxhim6xfkmieuj d1jz2taoy8nkzmve malicious Browse malicious Browse malicious Browse Southgate, MI Apartm ents for Rent - real tor.com#uae.html ninenewsalerts.nine. com.apk indicivil.blogspot.c om/2016/04/anant-amb ani-dating-sara-tend ulkar.html ng.yahoo.co.jp/sonch ic/dza312.html a25e8dc9589be0cf3b b malicious Browse e56deff3ef47211b95ce684f4d22 8fdec076 5fdf622a6bf3d f95084dc0 malicious Browse d36044e20fc6512ee1fcfc29ae6 1d0799f malicious Browse malicious Browse AMAZON-02-AmazoncomIncUS 53Payment.exe 753baf9f3312ab82986b62a35395 malicious Browse b8c0ac03ba6476bcf6a9f571a 21a41892 ao87si5uju.apk jones@ricohforensics.com 13orders exe 6341be988be00042c698511fd88 malicious Browse c97c618e6109afac40fdf5bed523 83bcdf18e malicious Browse b5aac54456a037d240f malicious Browse e9962db f4cb7fa3f6b09d ed258345f Copyright Joe Security LLC 2018 Page 15 of 500

16 Match Associated Sample Name / URL SHA 256 Detection Link Context wccftech.com malicious Browse malicious Browse keyserimpactseries.com malicious Browse com.affinity.red_sox _ apk DashlaneInst.exe 69894f963d a4e4 malicious Browse c16c2e6c838db482abc1 0bb7a3453a 0cbf83f1b879561d0041a0fef26d5 malicious Browse c570a b9ca7ecd9e5ae 4d9474c4 empireofdeceit.com malicious Browse PO# exe ics.be/kjsdch Proforma Invoice_d ocs.exe 66Bank Receipt.exe ddobeflpla yerbrsetembro F exe m/affiliate/referral.asp? site=rea&url=po p/en/ukc/1&aff_id=58 43_27027_1 9234_535127_1_357_ /educational/famzoo/ YXOpwUgugb.exe YxgDiqRWX.exe i111.tripod.com/ c6ec8728f7e909af51fa9a364a2f9 malicious Browse f61b5ec613dc37b18c95df2177f3 da9910b malicious Browse e765b41b0aa21f4e2313bd22 malicious Browse e9efb167b5ac8c2955f355f526aa ef6baaec1 8755e9c426db1f40ff1a68f100cb0 malicious Browse f33eb65a99b aad810bc4 0a5f9cb6 malicious Browse malicious Browse malicious Browse b61ce3d5d75fe4a cdfa malicious Browse c47ba6543fc568ab3293ed339 83ff717d8 60c5156e56e93c8ba14bee4af94 malicious Browse f2963be8c8d7bf469a892a1751d efd malicious Browse Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 16 of 500

17 Startup System is w7 iexplore.exe (PID: 3744 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3800 cmdline: '' SCODEF:3744 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) cleanup Created / dropped Files C:\Users\SAMTAR~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): Reputation: 8144EDECD76F29674F37118A B CCD7D5E794888AA583BE0B C933BCA63 CAE9CEBA3D795DB55C0D4BF0B841FDB FAB1A59DEAC55871CE55F5B9 BBB184F682F591CB3C294B E3F83F1A7B6155EE320795E9E74BBD4B1A08FC FC258301E522360EF FD401278F7FE8882F93A45D581235AC200A7 low Copyright Joe Security LLC 2018 Page 17 of 500

18 C:\Users\SAMTAR~1\AppData\Local\Temp\~DF0C2CE498BAF1ABCA.TMP data Size (bytes): Entropy (8bit): Reputation: D7B9B E9C180BC38BE C87542F65D20B40838D1627A21FAD B ECF6852C9FA1653E082CA6214A33EFAAF77EE6C747CA5152C44DED1AAEB81BD4 4D51D2B5BE90E4762D9A AD3589A8FBED C558E868DE77A8AAF61F390A6540B43D6D5E1B 9881FA651B151F4492ED7C CE2 low C:\Users\SAMTAR~1\AppData\Local\Temp\~DF142E9A1C319E8BE7.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Reputation: CA5B248DF68CF2E2BCD97DD3727BD F FAC0E1AD55AB27FD D370A2467F20EED82EDBA493B6B D814D7CAA17B2A0A8A0E7D2E2E0D11 330FDC6ABDD1E26B8F71420E09B A3FFD1D80247C69FEE01E5892BB3B241CD6855FE9B5DA8176DFBCD4 F4CC5E274307E17EC3450A57257D9DCB5B3ACBD low C:\Users\SAMTAR~1\AppData\Local\Temp\~DF C3B0434A1.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Reputation: 6595A97AFC06A55595C66A6F6DE D7C5C847378FE43A7A4E9B37C0DA08F3850B62B 89887A34D594C332ECF37F9401A187D2982ED817EF91C4867F9032FE275EDCF3 336CB8313EBB5A3C4613B45A7565F534927BF3AEFE56D3E6EB20CC7298A0DDD52A5EA00BFA F D65E410610D2D7105BA24753C0AA21A19EE04F low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\009434C E5F982E04C09638F data Size (bytes): 527 Entropy (8bit): Reputation: 3A65A2AC485C40FE61E4F443DF7794C0 976E7E9B7A5B2F2AA8406EF96109DE9CACB7F12E 9D118BE523CF25E3D471FF41F8ADAF0E289C05101FA22C63ED54AEBB852482B6 DE34D26BC8FE03989DDC9F37C37CFAC A57C400ED7685E0B8752B6B404A1C409789C4B314EA89094A24 C FA85663D78028F613E363950D0E6 low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 593 Entropy (8bit): B9B889B9EF82B6094D75D2F8CD3AC79 CD1AD6B634A0C40D1D46267DF58B806D9B5ABE B41E28B58A5852DCD609BF54D1C6BA5825E1A6C14AAC06857F6EAC688D0F 4B B2EDA93D8D2AE098FD4AFA85B360D1F4AB4FC9D0BED A983F894F1BBF58AB835B25C1B0 3F D76FBF614ED870D30ECBADB Copyright Joe Security LLC 2018 Page 18 of 500

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 Reputation: moderate, very likely benign file C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ F846F08BEFE0DD8112D932FEF data Size (bytes): 543 Entropy (8bit): Reputation: B9B4F88D68A9E4B614DFFACF8F56C357 5A709BCC5C2A CEB496A77DF5B AE9B71CC1F3781CF EF0DD8C3489EDB2AC0A71CABAB3F3C240FC6A255 C71F49875E681AC4EAF1C3E627B878E8C890764B855966E47F33FC12238B8E3110FA C18A87E50A3BB3 CBE4A07B9D26EC1D2108C02D moderate, very likely benign file C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E D9D67350CD2613E78E416 data Size (bytes): 1302 Entropy (8bit): Reputation: 55540A230BDAB55187A841CFE1AA E4734F757BDEB89868EFE A327695E D73494E3446B B3CDE3AE1C8584AC26E15E45AC3EC D90FB C899CB1D31D3214FD9DC8626A55E40580D3B2224BF34310C2ABD85D0F63E2DEDAEAE57832F048C2F500CB2CBF 83683FCB14139AF3F0B CDB4689C54 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E5B83846ED89B DE6F9B data Size (bytes): Entropy (8bit): Reputation: A89BB03B63739A2F370162DE0B7850A2 B9B84B2CC93526B71E DF96BB4A0A A97B04BB4CC82E093E9A D7A578DA2B933A0E630D6A5ED18B 9F9F6CEBC73A D35BD1CDFF27FC931DFE18B940C785C84E8CAC46F3B5C22A6F0B0F7C0E BCC 2E3137CE07DB56DF7C2BFF9FE46C46D020510C4 low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 data Size (bytes): 1378 Entropy (8bit): Reputation: 30206D81076DD9F9F32B5CC78323F71F 39C6F DCF15F9C1375E F086BA8 1A919AFBF59422FFF187ACCFB089C4E86B21A9D79A1E0657B0EF6F3F2547FA4B 621AB94C52247C188FC191437EE955EBBFED789E604417B571E03EA8558F3953F54AB1B900DE43B5F2F7B9475F5 E92F0F3A95C655DCB63D02339FA13FFB52E6A low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_3E08965F7725E887DAF43103EE data Size (bytes): 472 Entropy (8bit): C4388CC AB1AE9C1E270A4C394 Copyright Joe Security LLC 2018 Page 19 of 500

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_3E08965F7725E887DAF43103EE Reputation: ACAA125E9923C5938DC3E758694C77AB21FCCF C BC1B B310BD87FFF4DF051A9147F9E478EF C0 7E8891D67E7D78476F3297A07D3160BA5938F3E0B7DDBB9905CCCD5C1F7BC35D8BBD111D78555A6EE019561C78 DD7FEC17CC30910EAB9B54B A6375AE low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_9EBCCEA712D60C7D53EB7 4E90F82897C data Size (bytes): 471 Entropy (8bit): Reputation: AB34B76BF0E88A29869FEEE7DD1050A3 0DC7A3CD147909FCED23F24BCFF749FA8A608E4B EC22DD17C2444ED16757E0C6C52772CA30B3BDDDA21F1D2F7A6DE2938E7181AD 3D7833BC0B2F2887E8F9039F2977E E00D3697A5CC60448FC1FB301B6F852DFC2D14FC9556CD85E9D03C B863DDCCE9DCD54BB0CF723FA8D2FA95C849A low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ C60AE785DBDEF5542B4B6F5 data Size (bytes): Entropy (8bit): Reputation: 6090E2775A54231C023D0A A64DE3BF4C05B972131CA995CAAF3B37081BCF D9A108F743A660345A22D6C F42FDA889DF4D36DDE0B48A93752A E89CC76B5D8B6EFB9BE28152B65A D0D9F82628C476914EE C496FBD DE5C 1517D15229B945223B70679AB12F7A1D8C23 low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B177 1 data Size (bytes): 1730 Entropy (8bit): Reputation: F2ABF81AD1457F5508AD D5 E4DEE7B3B0A16ADDC60E3D4C697E3F E 7A5D7B329D3B E B11C3F31FCA3AE3B6CDCBB664CCC8342E 4B11F2B6ABCE1A5F0FF0B7513E838F378FEB73FE2EACF1E44DA5E4989F3A04E1DC B5F4786E86E17971 F BF7EE4B4E56228FA0E6B low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ D2844BEC28A6B08564CE181D7_A7C7DD9037AF8FBB48D3D ACA3A0FC268 data Size (bytes): 1776 Entropy (8bit): Reputation: 0D9B78FD5E9DBAB7FAC42E5B618A6B33 93DE E A74285EDFECBBED EF0795A089AC9027ACC6F5C719D2044CB19BEAFC66B00B4E478838C4A99ADDF 2579A9352A91C40C E08507AB34B044C9698B63A45FD63973AABC3E DFF DDA50D676A116 65FD30A6CFE63EA90A074DB6CA9B2FED7988 low Copyright Joe Security LLC 2018 Page 20 of 500

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_08C5B89EC9144E59647A B81 data Size (bytes): 1419 Entropy (8bit): Reputation: BA353F1E58983C0308ECA86DBEF5C1E7 93E8BD5D04662E20F9206B8193A375E05CCF179A 75FF40FEE3062A3F9E6B89C4954DD25DA28DE37174BBF901085C8D3D3E16361D 72E075C20AC43715B111A6B5293E0712BCB5E395E98EC648D086944D0816C124564F50696D8C1424C0393B6217BC DF34F AB6E176F B532B low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF D1D277A171D8DF7B_2D6AC2439C2E03B F46911C544 data Size (bytes): 471 Entropy (8bit): Reputation: 5E61931D52DDC89CBF65320E7C0C995F 9E2E64DED3D5ABA4EB6F9006A8B6F5C5598E5633 F9450CE7F26D21E253E7B1A AB2FFC9B EF1AEAE09BA6 4E6ECD655324ABC0276E8EB5B6C1ABF3B2583F210D4A4B48BA6C01D07EDC6D277B0E8141C94C63EBAC99D FFE BE460F2D3383E1E298F75CEB92A low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D data Size (bytes): 602 Entropy (8bit): Reputation: EB2F48280D3687C9DF259EAA9 743AD8CBAEEA344923FADEA0ADC BF69E7 B1B5D70F59B8A64E4E3C6B3FCDA5A5B52F48AC75E7CE630B654DD7B6582CDDCC 58AA3837E3CE59E5BACFFEFF2B06FBD307A84BE21B25DF2830E5C904D70B0A66DDF15A99C593C271508E16EA8 6082EF5A557698BE1BA278F18FF0F2420BC0D77 low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D A90937F0752C8B950AB data Size (bytes): 712 Entropy (8bit): Reputation: D94F1E22F1BD768583C33CA604B04C7F EA77754E95A8A083F2624E68D87D6BD747A0A138 23F85655DD756A38954FD63F2218B4F6FA6BBFFB5467BA02F3143DC7E4CD36C2 12FB2B5E831F474BCF2153EE7EEC2C727B2570E ECEE0DC4C03B693B03F1A79BE4E E638F4 E4DCA79C364E BAF5CA94258BA246BC moderate, very likely benign file C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\410002B7DF52B20345A44DEF490FB5D7 data Size (bytes): Entropy (8bit): A1D DAC000647F1C22A02C 57B4347B706B149B2FF3C211CBBBF519DF F2EC6F2EB5EDC1C597353CE67D0C9EFFA45AE32C6B3E3CC1DBBE391193CAFB9D BEE34779D45B67E585CF C179206FA88B975D6650B4D1ED5AD F930F637D2C4245C443C867A014F 821EDCC2F99DD370E9334CF9235C B Copyright Joe Security LLC 2018 Page 21 of 500

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\410002B7DF52B20345A44DEF490FB5D7 Reputation: low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5024A99DB487E61F859A7848B9CAE2C4 data Size (bytes): 665 Entropy (8bit): Reputation: C0FC7EC6D88ECC67E0923EE47D40E10B CD441B B732BB92E3B22F62F4 B4B70625D79853B396A7344C8481CCB068A115DC9B442303C40B26999A86DD6E 63C93C1B2E363824BABDD F973EC3FEF8E3CE0347E7F55D E2B351CB401B016CBA962D2B B8F79AA7E7693A28ECCF0A695C1C2A9FFB3670 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77 data Size (bytes): 727 Entropy (8bit): Reputation: 948D0DC4D262294B4D03D4EEEE2A322A BE A8F442F51325D97DFF675D24020AC DD4F77CA1ED44BA1D8BCBCBEDD8ED8E0893D FE00C232B121C 73D7634C7606C0F95CBC9585FDB53E918EABD3307DEE3D2B4417D70AFFCE C676F2E7CC9339F4859AA1D 6315FDF759B3662CD0A4F950F25D8EA13FE077 low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B 4 data Size (bytes): 471 Entropy (8bit): Reputation: 802F7F04FE69EF2490B753E99EE4430F 5F73325A65FE74BC180C6CC DA9E2B370 D12638F8E3ECCCEF376A114780C3D6BB136C97F2A5EB FD0519CB EC51BE4FE63B006D4D819BD4142B1F611573D519C AC382F2F74C4EF84BB784F8F527E00473DD58C 0680F039437D6C4C535EA97E4707B822106B3 low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Size (bytes): Entropy (8bit): Reputation: Microsoft Cabinet archive data, 6509 bytes, 1 file DA4ABC8C9A1FCFA4161EFE06CB2935AF E33672FBA3E351EF2BB6F0C62DB1A5C3EEA0A1F9 C25B1A0AFC65B15A4B2278A85B519A C71BDA4D848D852CC25DB46 2E59E847EBFDD74F752CD6E974075EA69B5DAA7AA5CEA092DE9C5BB35BB CCEA7C7B041D7C30847EAB 0FF6FFB58E4E18217F7B9457E426188C07E1375F moderate, very likely benign file C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E F2A5 data Size (bytes): 1073 Entropy (8bit): Copyright Joe Security LLC 2018 Page 22 of 500

23 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E F2A5 939F69F9FD3206A BA45A E758CA442E729D3A47D3FD653E D1F049 0D877C5F8B67B85B1BEDDFBBB1D8B82BB6D22E41EFCAF4622A328BAC795092CA 6F4583D60AD0F37BA19ECF0B076529B3BD57EB9791E7E9AC8AFFF AD1BAF1E80C8218A10E49A4AD2EF0 CF D596C6D70011DFECD62AE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896 data Size (bytes): 439 Entropy (8bit): A76B87E3E2A9F0C864610B7CCBC3C AA0762C939E3155CCC4E051F9B2EF5B1D060299D 2176AE7D47513B54DADD14FF28C141A7BDC92EF6F84D211C B60D8644D D4D41551C97E8E422A9D7D9CEA3953B3A486E83B711DCB11E04CA9613A179272B3A685268F95BF78DB0EFB6B51 2C373A1F B4D2DBA6BC7ABA5DEADA106 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B B5E195ECB0E8F243A4 data Size (bytes): 896 Entropy (8bit): A2270D666AD772CACB9A7AAD78B85EC5 DDB920ECEA12AEA4DD568F85218D615402BEB2A C1337A297E7CC32972B6D95F9421A1380BE59D7DC69F8EAFE5221F8FCD 51D4AE27AD599A9D02E13697ECE7851CA5DC65FFF9C7D172D614F6DB3ECD8A3B5BCA9B18CFE24E4C8073B4E5 6A6E6B2925E71EFA2E26CA30BA77CE2DE50C705E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90 data Size (bytes): 462 Entropy (8bit): A68A2AE020719B8942F12700C2AA7326 8B382EF2E4FE11578EB042012F49DA87F2CC56E9 D605EF4CA0057C59A4E90EB65A86BFFCA2A76509F5D67A2B7C6FCB66DA48B95F E9E343A249A7E304703D C17A870C4245A84755B2592A6736A70CD921D0B249A14A7EA4E3C9674CED206B E0D D A722A7495CE672BAE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 531 Entropy (8bit): F0300B194C6A43ABCFF4E4872B8F57EA 3954C9C90B15DAD1AE69C550EFB30DFCBF315C ECBD2B FED EC33AC002A13C D9E3AF29CD FC91F10927EC0E273ECFD4EB F5A59DB0EBD B7128FFDFAA9A410EA17C514A5E2C197BAC4990 CA2F392BF6886CBC54D378A3E2DF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50 data Size (bytes): 434 Entropy (8bit): CA B3A8B8E912E7D2138B Copyright Joe Security LLC 2018 Page 23 of 500

24 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50 DEEC92073BEA F ECF6F2750B1B4 A7692AA2B5B2664DE344B922A091B7BA6F4FA01A4FFC80F279BAC31D4A3E468B F8DC07C60ABEAB1B60DED14C3D51C25A41F28FA7EC657A06038ECB2AFEF D FAFBD A 8ED5A2039A20B37F3A341518BACDD319C7B6D02 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 471 Entropy (8bit): B888F6ACEDF622DFC0182A8197CCE4 F96CB2A18EDEAF9CB9755EDCF5ED77ADDDA02F32 C0DCF3DF26FEA5DD85A9429DE3A8F1AF2BC34FD092A21A951CE08EDE2B44C9EA B96343B16789B2E97AA678E14F73F72FB8C28841CF93F0B2C63E2ED9CE53255F5BBD8EBA101405FEDBD2 CDA0969AFD5DC254F22DF179E50BD5E6F208E9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD data Size (bytes): 531 Entropy (8bit): F0300B194C6A43ABCFF4E4872B8F57EA 3954C9C90B15DAD1AE69C550EFB30DFCBF315C ECBD2B FED EC33AC002A13C D9E3AF29CD FC91F10927EC0E273ECFD4EB F5A59DB0EBD B7128FFDFAA9A410EA17C514A5E2C197BAC4990 CA2F392BF6886CBC54D378A3E2DF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF data Size (bytes): Entropy (8bit): AE11131EE61C1B19321A06B058F71 323CA57768CE8241C68C911DE6B1B0D5ABB62CF2 EC266BB05664C5D71D3C53CE1D6C47DB9212CCFA6F9C04008AD582AD95D52AFD E5688A26EDAE003E7BC553C1F4B9311F5F61888EAAE1BA23D8662B1968BAAD4ABB622D9947BE E 6332B0039DE6FBB6FEE560F6EAE8EE2D75D8A7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8AD 6 data Size (bytes): 471 Entropy (8bit): FBEE9664EB7CA83DEDAD799B5D5 8A149F69A19C8E2B2A42A81F50EF5B7347ED8AD9 94F34DD7D9FB82B779FA4E2CE66671C752FAE52D2E0EF3B36A2BC21AB6AFF37F 51269D01331BCE68C21DEE6D9BA5B8FC1A3161EE5F59EAF177CDB8C97B973890BE1C8D9F F1FF74C5A4 DD000EB817C256BFA0D95CBEA2E5F99220BC1C9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC _93E4B2BA79A897B3100CCB27F2D3BF4 F data Size (bytes): 1426 Entropy (8bit): Copyright Joe Security LLC 2018 Page 24 of 500

25 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC _93E4B2BA79A897B3100CCB27F2D3BF4 F 897D05958FB6A15CFEAF53E7DD76FD18 31BB72EAE66E1FABAC6122B64AA5510C7F69B5B6 68C2BEA68659ABB35714BBC89D1D790A6A0949DBD7E8BDE86D47DF2C4F6A9A5E B83BBFCA136EAAFF8C10CDE1BFF0C08D6D4163C91C3E3F218BB7D54BFCED4A41970CC05C2E54814DE2C3158C A16894A355E9D2DE9AF2B225FE0CD2B6B02BCD5C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, bytes, 1 file true 781D21D8FA90334B1124ABB8FAE2D451 ACC2C199307CD2B265ABF33698AAF09E7E8C5B24 60D51BF555D2792CAD001CE546E9AAE7E0D1E860B905E75356EB29F9C86CBAB3 F91F9FD6EA28001B1C A DC65C697FB25ACF62CC607613BDB663C9FBC0D9BD07D56C83D1 A9794EC97A B7D5A000649DAC82863F7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4405 Entropy (8bit): BF2FFE7C12AF123F5B26546A50D05E C2566C AFFCB CF75E5819AF7771 F C1FC0281C842B1EEFF057750C956B863D0AFE9A3B1576F4F 62CE0C385A944315F13368CC5FAAB608089C1B AF0C5EFDCA5137FEE4590BDE4EE5C7EE4115CED9 63EBA D019C89CE64CFC6D E5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8D1B12BFF46FB324D465523E1811A3DF_7C7D CBB2B828DA05B9020C09 D data Size (bytes): 1777 Entropy (8bit): B8ADC02CC C6C4A15D39DC D E21442D1027BDCAD17D11BE3 F41CAACD8CB46FCA36B8ED B7E1DCC98AEF1C047F41B25C58B9D8218B8 3063D7A343FE7BC4B64F85ADAEDB585CFD9B275C827D15061B A9E475FC60BA331839AFCFA857C8B10F1 FF7D E291C6E50C0825CAD3C4CD4724C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F B52012CE8E279D314C_8F7B82450CEA3363B2BBCE456946FF7F data Size (bytes): 471 Entropy (8bit): Copyright Joe Security LLC 2018 Page 25 of 500

26 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F B52012CE8E279D314C_8F7B82450CEA3363B2BBCE456946FF7F B80B44BA3B1701EEBBB9CE200125BB CE6F583F85CB F1B8BE108E23BC76F 6100F099E80B41D62F44F876B7B86BEF595D0637CC1BEA70EC0B4071B4BF3EB6 82BFC412F10FC784120F280E2E793AE3EABA74EB5D617FFA58E5D747CFEE0B7BEEFB20770AFDE621663BE05F6 6FD696DEDD6059BCE68833FEE2F5E4B5409CC08 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AE AA803AA0F6E35ADA data Size (bytes): 1340 Entropy (8bit): D5858EBC CB7AC1E17F726C5 FF67367C5CD4DE4AE18BCCE1D70FDABD7C EAE72EB454BF6C3977EBD289E970B2F D0D26F98D0F0D6A9CF17 01F42C3D65C5E E5EDD829B37E45ED4C46B15373CA D D0F4044FD7E7F605633E9D FA5F417A72C7B5F4E5C266B9BE27E51 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A6 2 data Size (bytes): 1744 Entropy (8bit): E605C852B192A6D208A4CC1053F CEE0DD CEBF3ADD9EE1C1C4C53D400F24 10E00481CF9A7111D16D4F13E4ECFBE8C3278C10EF0999AA8A A7CB6 497DE21CFC8EBFE57C1DD48BAD80AD67451F53811BF3E280F3B725A82846D9B0B61A20EE4A82000EBC257D27D B1A1FB6CB0BA6576CB5BEED96EB82B4EF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD data Size (bytes): 1548 Entropy (8bit): C B F26 8EA73C018205F0AE59203A469D5914ACC45DD CC5A84784BF80698F56397C1F437B7F3EA3ABD69C98A5ACCF7D95F0BD5620 C95A42CB993196E06CAD1C4FD896C54E8D58A98781A99B6F3E5222DE0EE6D7FA9783F53A14BACB71B093193CF8 0D4360DEBD4BA55BDF06D46B7B1D73B274E3EB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F data Size (bytes): 608 Entropy (8bit): BA4BAFED05B83120D4319B565AA08 14A D60E10A0B834EE6C9B9F762F83D FCE2ED7B48D566A1BCD6EFBA6A4AC8C1BA9892B7CFC95AE4BDEA7534A323C6A6 3D9C347BC2687A66F004D4F87773A5F0B3CBBE6505E015AB253B D0CD92E5FE8F37DD735A761203DF3A CACC8C326C57E43FCC7E768AAD3BAFFEEE11A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B data Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 26 of 500

27 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B 791AE11131EE61C1B19321A06B058F71 323CA57768CE8241C68C911DE6B1B0D5ABB62CF2 EC266BB05664C5D71D3C53CE1D6C47DB9212CCFA6F9C04008AD582AD95D52AFD E5688A26EDAE003E7BC553C1F4B9311F5F61888EAAE1BA23D8662B1968BAAD4ABB622D9947BE E 6332B0039DE6FBB6FEE560F6EAE8EE2D75D8A7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D _D9B9F37ECE595B0B7B6AA12451D392C F data Size (bytes): 1754 Entropy (8bit): C3FC108BA26E5BFB3B6AD B692 8AA7C36B1D3C C BA1C8235A7A4 8AFAC570967F2F5F203BDE98CD0633FFD3F333E22BE09E308BBE3A2326B983FD 82F918DDDB6449D63C9C50B0F34E2D8D2EF9BD4B75E26B6B3C56F7EA4DED588F45D4C23546CF1FEB44587C884 ECBF6FA2F46D71AB5FDCD0625D6BDDFD47C39B4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5FD5BF0CE6372B1CAFE381FD0BC969C data Size (bytes): 429 Entropy (8bit): EC298C64E5AACBC4DBD62633AA53A80B 5A5CA27645EBCE6B9AEAFC9A803C39FD3E2C8B5E CC4BEAAB8386E2700C8CED0C4556B2C24DBA47B6FE9F0BD4D9AB2B408C9355A9 874F02B0FCB2A7A00C79A E92B8E45A8BC6FF34B90E079578F3E4C A26659B737B2BB10CB662 9CF95F06BAC0F6D4240FCEA2675DB472AABF1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C82E3AF5B11B77A231BF64A98DE549F1 data Size (bytes): Entropy (8bit): CC6C491D17B4FAEF843BA388417D29D DE66494A6DCE50AA B7903C AB716332B360D4C7D33A755C30E42427F56E2FF95CC346A6CB74619E6268 CA43CCBF5E B2E2BA72B7A18FEEA8A9259BE96E19A888216FD D78E52C7799AAB6AA1D351 A51288A5496E2CBFA47991DE93624E F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D data Size (bytes): 812 Entropy (8bit): F362F2474B26A1F26E07B1E31BBD10C6 FFEBBD2A2DFBC9D7C2BD4F3167CC9D1CFC7D9A90 4E7A4612A10F78996B5E4B0C26308E33F46DE6D AF02C26E2 F5A2FB0C97B80947A7C2D8CBB7E9442E A8F4B0D17EA5AE8E F76B15803D78146D498E14B5A 4DF78A1DEE4667AF71FBA4EFA1E0CB53B8E54 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CCFB45DC01E4F1B903156D3DCF37211F data Size (bytes): Copyright Joe Security LLC 2018 Page 27 of 500

28 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CCFB45DC01E4F1B903156D3DCF37211F Entropy (8bit): E0EA380AC7C253EE B23FA0816A41E452DBED9FB3C9858F69F80C3 D04C00BBAE16ED2A36658CB0DF24D0B3DEE01155BC9B FBAA533C AEAB955C6EC1B8DBD9DC F AA8DE86C9E9A99E1A5A0AF5586F1C818AF0263A18AFE9E A03C D78748C20D9B7F81EE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86D E data Size (bytes): 1435 Entropy (8bit): F292CE9F0F AC7EAA875A45B ACE4024BCC2A6D88ECF BC8DBD3A 3A2F313B C4C1D8DAFC631F6E78A4825A F650B F752 78DC0E34F5DCA4CE6BED9548E89D0DC993000DB3CB8ACC3B99775AAB04ED5521C315F B13575D5D7C9E 2ABC34F4523FE185940E79408CC58ED26422B00 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DC6B80144D0FCD1DEE F8E1_8CD9E2FBA1704DD67C188 AEE51D99097 data Size (bytes): 1776 Entropy (8bit): FBF672A8E5E474B91602FE7A4E 2478E8F66D186B561401CF574447E486E4E057AB 1CBCBF DDB2F6B C6E970773A5B0FB7E42D006AB83D2B5AF7 62BC86E04E6C138C3656E23C17E6717C9BF3EE5E9A900522FB16E88BA744A5179D729A0BFFA064CC2C7A7335E7 2DCFEB5B4D1761CDE4C92044F73C677DE2A680 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_2C78B96D8BDE6CC53F844 5B4BA9DF172 data Size (bytes): 471 Entropy (8bit): F78F046B76A8A1197D5C19CEFC9BEE 1CE83955C52ECCAFAF796E4ADF52D5178D36CC81 B F95CF891F406F634627A8AE05248EE82AD23065E526177E887BAA1D B8C37086F19BB188649D9A10F32661A4F FCE3C56253EAD7AC615192E5B0908E1F8F28B2F89223B39 8F6E6462CE DDDDCB982FA1A622 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DD05AD37A2ABDB C0170F4FC2 Copyright Joe Security LLC 2018 Page 28 of 500